CVE identifies that the UiPress lite plugin for WordPress is vulnerable to remote code execution because its uip_process_form_input() function executes user‑supplied arguments without verifying the caller's privileges. This flaw allows authenticated users with Subscriber level or higher access to run arbitrary PHP code on the web server, compromising confidentiality, integrity, and availability of the site.

All releases of UiPress lite up to and including version 3.5.07 are affected. WordPress sites that have installed these versions of the plugin and have it active are at risk.

The vulnerability has a CVSS score of 8.8 and an EPSS score of 2%, indicating high severity and a low but non‑zero probability of exploitation. Because it requires authenticated access, attackers must first compromise or hijack a subscriber account; from there the likely attack vector is an authenticated AJAX request to the plugin's endpoint, which triggers uip_process_form_input() and allows arbitrary code injection. The flaw is not currently listed in the CISA KEV catalog, but the combination of high impact and authenticated exploitation warrants immediate action.