CVE-2025-1309

Name of the Vulnerable Software and Affected Versions UiPress lite versions up to, and including, 3.5.04

Description The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to a missing capability check on the uip save form as option() function. This enables authenticated attackers with Subscriber-level access or higher to update arbitrary options on the WordPress site, which can be used to gain administrative user access.

Recommendations For versions up to, and including, 3.5.04, consider disabling the uip save form as option() function until a patch is available to prevent unauthorized data modification. Restrict access to sensitive options and settings to minimize the risk of exploitation.