What the vulnerability does
01Description
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uip_process_form_input() function. This is due to the function taking user supplied inputs to execute arbitrary functions with arbitrary data, and does not have any sort of capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server.
Explanation of Vulnerability in Simple Terms
02Summary
UiPress Lite versions up to 3.5.07 contain a code injection vulnerability that allows authenticated users with low privileges to execute arbitrary PHP code on the site. The vulnerability exists in how the plugin processes user input without proper validation or sanitization. An attacker with a low-privilege account can inject and run malicious code, gaining full control over the site's functionality, data, and files.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with the privileges of the web server.
Potential impact on your site
04Site Impact
A compromised low-privilege user account can lead to full site takeover, data theft, malware injection, and defacement.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege authenticated account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 15, 2025
CVE published
April 8, 2026
Record updated
