CVE-2026-2294 MEDIUM

CVE-2026-2294: UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

Vendor Admintwentytwenty
Product UiPress lite | Effortless custom dashboards, admin themes and pages
Weakness CWE-285
Published March 21, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_global_settings' function in all versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings.

Explanation of Vulnerability in Simple Terms

02Summary

UiPress Lite versions up to 3.5.09 contain an integrity vulnerability that allows authenticated users with low privileges to modify data on the site. The vulnerability requires network access and valid login credentials but no additional user interaction. The impact is limited to data modification without affecting confidentiality or availability.

What an attacker can do

03Attacker Capabilities

Modify site data or settings through the admin interface.

Potential impact on your site

04Site Impact

Authenticated users may be able to alter site content, settings, or configuration beyond their intended permissions.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege user account and network access to the site.

Key dates

06Disclosure timeline

March 21, 2026 CVE published
April 8, 2026 Record updated