The UiPress lite plugin for WordPress permits authenticated users with subscriber-level privileges to invoke the ‘uip_process_block_query’ AJAX endpoint without performing any capability checks. This missing authorization allows a malicious user to retrieve sensitive user data such as password hashes, e‑mail addresses, and other profile information, which could be used for account takeover attempts. The weakness is a Missing Authorization (CWE‑862).

All releases of the UiPress lite plugin up to and including version 3.5.08 are vulnerable. Any WordPress site that has installed these or earlier versions of the plugin is exposed. The product is the UiPress lite plugin by admintwentytwenty, used for custom dashboards and admin themes.

The CVSS score of 6.5 indicates intermediate severity. An attacker only needs to be authenticated with a subscriber or higher role—no additional access—making it easy to exploit once legitimate credentials are available. The EPSS score of less than 1% suggests a low current likelihood of widespread exploitation, and the vulnerability is not listed in CISA KEV. Nonetheless, because WordPress plugins are frequent targets, the exposure remains a significant risk for sites that have many subscriber accounts.