The UiPress lite plugin for WordPress contains a Missing Authorization flaw (CWE‑862) that permits an attacker to bypass standard access controls, allowing privileged actions that should be reserved for authenticated administrators. Based on the description, it is inferred that this broken access control can enable an unauthorized user to view, modify, or delete site content and configuration settings, potentially compromising the entire site.

The flaw affects UiPress lite installations by UiPress up through version 3.5.09. Any WordPress site running this plugin at version 3.5.09 or earlier is susceptible to the breach.

The CVSS score of 6.3 indicates medium severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Based on the description, it is inferred that the attack vector is likely remote, occurring via the WordPress web interface where the plugin resides; an attacker may require only minimal or no authentication to exploit the broken access controls. Based on the description, it is inferred that if successful, the attacker could gain full administrative access, enabling changes to site content, settings, or data.