Overview
CVE-2025-11815 is a medium severity vulnerability affecting the UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress. Versions up to, and including, 3.5.08 are susceptible to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function. This allows authenticated attackers with Subscriber-level access or higher to change arbitrary plugin settings.
Technical Details
The vulnerability stems from the lack of proper capability checks within the uip_save_site_option() function located in the admin/core/ajax-functions.php file. This function is responsible for saving site options based on user input. The absence of these checks means that even users with minimal privileges, such as Subscribers, can trigger the function via AJAX requests and modify crucial plugin settings. Other AJAX actions are also reported to be affected by similar missing capability checks.
CVSS Analysis
- CVSS Score: 4.3 (Medium)
This CVSS score indicates a medium severity vulnerability. While it requires authentication, the low privileges needed (Subscriber level) for exploitation contribute to the risk. The impact primarily lies in the potential for unauthorized modification of site settings.
Possible Impact
Successful exploitation of this vulnerability could lead to a variety of negative consequences, including:
- Site Defacement: Attackers could modify the dashboard appearance or other visual elements to deface the website.
- Privilege Escalation: In some configurations, modifying plugin settings could potentially lead to privilege escalation, allowing the attacker to gain administrative control.
- Data Manipulation: Sensitive data managed by the UiPress Lite plugin could be compromised or altered.
- Denial of Service: Maliciously crafted settings could disrupt the normal functionality of the website, leading to a denial-of-service condition.
Mitigation and Patch Steps
The vulnerability has been addressed in later versions of the UiPress Lite plugin. It is highly recommended to update the plugin to the latest available version as soon as possible.
- Update Plugin: Navigate to the “Plugins” section in your WordPress admin dashboard.
- Check for Updates: Locate the “UiPress Lite” plugin and check for available updates.
- Install Update: If an update is available, install it immediately.
- Verify Update: After updating, verify that the plugin version is greater than 3.5.08.
