PT-2025-10049 · Unknown · Uipress Lite

Dale Mavers + 1 · Published 2025-03-07 · Updated 2025-03-08 · CVE-2025-1309

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UiPress lite versions up to, and including, 3.5.04

Description The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to a missing capability check on the uip save form as option() function. This enables authenticated attackers with Subscriber-level access or higher to update arbitrary options on the WordPress site, which can be used to gain administrative user access.

Recommendations For versions up to, and including, 3.5.04, consider disabling the uip save form as option() function until a patch is available to prevent unauthorized data modification. Restrict access to sensitive options and settings to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-1309

Affected Products

Uipress Lite

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-1309 · Security Note
• https://plugins.trac.wordpress.org/changeset/3249865 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6754ba34-0dc7-40a5-9548-a5f77db0df53?source=cve · Note
• https://t.me/cvedetector/19791 · Telegram Post
• https://plugins.trac.wordpress.org/browser/uipress-lite/tags/3.5.00/admin/core/ajax-functions.php#L625 · Note
• https://twitter.com/CVEnew/status/1898246407229755671 · Twitter Post
• https://twitter.com/cybercronai/status/1898056881966293051 · Twitter Post
• https://twitter.com/CveFindCom/status/1897912889240859091 · Twitter Post