CVE-2025-11815

UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

View on CVE.org

Published Nov 21, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected.

Analysis

Technical impact

The UiPress lite plugin for WordPress has a missing capability check on the uip_save_site_option() AJAX function in all releases up to and including 3.5.08. An authenticated attacker with at least Subscriber-level access can invoke this endpoint and change arbitrary plugin settings. The change can alter dashboard layouts, themes, or other configuration options, potentially disrupting site appearance or behavior without granting direct code execution rights.

Affected Systems

WordPress sites using the UiPress lite | Effortless custom dashboards, admin themes and pages plugin, version 3.5.08 or older, by vendor admintwentytwenty.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is very low at present. The vulnerability is not listed in CISA KEV. Since the exploit requires only a valid authenticated session, the attack vector is an authenticated request; no privilege escalation beyond the existing account level is needed. The impact is confined to configuration changes rather than code execution, keeping the overall risk moderate.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

admintwentytwenty

UiPress lite | Effortless custom dashboards, admin themes and pages

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.5.08

No data.

Vendor	Product	Versions
Uipress	Uipress Lite	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the UiPress lite plugin to the latest available version that includes the proper authorization checks for the affected AJAX functions.
If an upgrade is not immediately feasible, restrict or disable the impacted AJAX endpoints through server-side access controls or by applying a temporary custom capability filter.
Enforce stricter role management to ensure that only trusted users hold Subscriber or higher privileges and audit user permissions regularly.

Generated by OpenCVE AI on April 22, 2026 at 12:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.241% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/uipress-lite/trunk/admin/core/ajax-functions.php#L396
https://plugins.trac.wordpress.org/changeset/3398753/
https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8d7397-0201-4194-8604-057f905ef10b?source=cve

History

Nov 24, 2025 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 24, 2025 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Uipress Uipress uipress Lite Wordpress Wordpress wordpress
Vendors & Products		Uipress Uipress uipress Lite Wordpress Wordpress wordpress

Nov 21, 2025 7:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The UiPress lite \| Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected.
Title		UiPress lite \| Effortless custom dashboards, admin themes and pages <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Weaknesses		CWE-285
References		https://plugins.trac.wordpress.org/browser/uipress-lite/trunk/admin/core/ajax-functions.php#L396 https://plugins.trac.wordpress.org/changeset/3398753/ https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8d7397-0201-4194-8604-057f905ef10b?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`