The UiPress lite plugin for WordPress has a missing capability check on the uip_save_site_option() AJAX function in all releases up to and including 3.5.08. An authenticated attacker with at least Subscriber-level access can invoke this endpoint and change arbitrary plugin settings. The change can alter dashboard layouts, themes, or other configuration options, potentially disrupting site appearance or behavior without granting direct code execution rights.

WordPress sites using the UiPress lite | Effortless custom dashboards, admin themes and pages plugin, version 3.5.08 or older, by vendor admintwentytwenty.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is very low at present. The vulnerability is not listed in CISA KEV. Since the exploit requires only a valid authenticated session, the attack vector is an authenticated request; no privilege escalation beyond the existing account level is needed. The impact is confined to configuration changes rather than code execution, keeping the overall risk moderate.