The UiPress lite plugin for WordPress allows any authenticated user with Subscriber-level access and above to modify site options without a capability check. By exploiting this missing authorization in the uip_save_form_as_option() function, an attacker can change key configuration options, including the default role for new registrations and enabling account registration. This can elevate the attacker to an administrator and grant full site control. The flaw aligns with CWE‑862, Unauthorized Access to a Restricted Resource.

WordPress sites running the UiPress lite plugin version 3.5.04 or earlier. The vendor is admintwentytwenty, and the affected product is UiPress lite | Effortless custom dashboards, admin themes and pages. No newer versions are mentioned in the input, so all releases <=3.5.04 should be considered vulnerable.

The CVSS score of 8.8 indicates a high severity vulnerability, and the EPSS score of less than 1% suggests that there is a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog yet. Attackers would need to be logged in with Subscriber or higher role; the lack of a direct privilege escalation path means the risk is confined to authenticated users, but because the user can change options that grant administrative rights, the impact is significant. The exploit requires no special network exposure beyond normal authenticated WordPress access.