CVE-2025-10938

Name of the Vulnerable Software and Affected Versions UiPress lite plugin for WordPress versions prior to 3.5.09

Description The UiPress lite plugin for WordPress is susceptible to exposure of sensitive information. This is a result of absent capability checks within the uip process block query function, which is accessible via AJAX. Attackers with subscriber-level access or higher can potentially retrieve sensitive user data, including password hashes and email addresses, which could lead to account takeover.

Recommendations Update the UiPress lite plugin to version 3.5.09 or later.