CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected.
Explanation of Vulnerability in Simple Terms
UiPress Lite versions up to 3.5.08 contain an improper access control vulnerability that allows authenticated users to modify data they should not have permission to change. The vulnerability requires a valid user account and network access but no additional user interaction. Site administrators should update to a version newer than 3.5.08 to remediate this issue.
What an attacker can do
Modify data or settings within the plugin that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users with basic accounts can alter plugin configuration or data, potentially affecting site functionality or other users' experience.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
