PT-2025-19911 · WordPress · Peprodev Ultimate Profile Solutions

Kenneth Dunn · Published 2025-05-07 · Updated 2025-05-12 · CVE-2025-3921

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions PeproDev Ultimate Profile Solutions plugin for WordPress versions 1.9.1 through 7.5.2

Description The issue allows unauthorized modification of data due to a missing capability check on the handel ajax req() function. This enables unauthenticated attackers to update arbitrary user's metadata, potentially blocking an administrator from accessing their site when wp capabilities is set to 0.

Recommendations For versions 1.9.1 through 7.5.2, consider disabling the handel ajax req() function until a patch is available to prevent unauthorized data modification. Restrict access to user metadata updates to minimize the risk of exploitation. Avoid using the wp capabilities variable in a way that could allow attackers to block administrator access.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-3921

Affected Products

Peprodev Ultimate Profile Solutions

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3921 · Security Note
• https://wordpress.org/plugins/peprodev-ups/#developers · Note
• https://t.me/latest_high_impact_cve/2296 · Telegram Post
• https://t.me/cvedetector/24667 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a881ca02-cef9-4f4b-8a62-e241c4c80004?source=cve · Note
• https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L1483 · Note
• https://twitter.com/cracbot/status/1921883126579757371 · Twitter Post
• https://t.me/cvetracker/23228 · Telegram Post