PT-2025-47672 · WordPress · Uipress Lite

Abrahack · Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-10938

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions UiPress lite plugin for WordPress versions prior to 3.5.09

Description The UiPress lite plugin for WordPress is susceptible to exposure of sensitive information. This is a result of absent capability checks within the uip process block query function, which is accessible via AJAX. Attackers with subscriber-level access or higher can potentially retrieve sensitive user data, including password hashes and email addresses, which could lead to account takeover.

Recommendations Update the UiPress lite plugin to version 3.5.09 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-10938

Affected Products

Uipress Lite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10938 · Security Note
• https://wordpress.org/plugins/uipress-lite · Note
• https://twitter.com/VulmonFeeds/status/1991875557814837288 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d8aa06eb-774a-4cd9-bd35-2d6409475696?source=cve · Note
• https://twitter.com/CVEnew/status/1991776203322323278 · Twitter Post