Junglewise Threat Intelligence

CVE-2025-11003: UiPress Lite privilege escalation via unauthorized capability check

CVE-2025-11003 · Severity: medium · CVSS 6.4 · Published 2025-11-21

Executive brief

UiPress Lite is a WordPress plugin that enables users to create custom admin dashboards and themes. The plugin fails to properly verify user permissions when saving templates, allowing lower-privileged users (such as Subscribers) to inject malicious JavaScript code into dashboard templates that will execute with administrative privileges.

Technical details

The vulnerability is a missing capability check in the 'uip_save_ui_template' AJAX function, allowing unauthenticated privilege escalation. The plugin does not verify that the user has the required permissions before allowing template saves, enabling authenticated Subscriber-level users to craft templates containing custom JavaScript. The malicious script executes in the context of the WordPress admin interface when templates are rendered, potentially allowing attackers to modify plugin settings, create administrative accounts, or exfiltrate sensitive data. The vulnerability affects all versions up to 3.5.09. Patches are expected to introduce proper role-based capability checks on the vulnerable AJAX handler.

Affected products

  • Uipress UiPress Lite up to 3.5.09

Timeline

  • 2025-01-21: disclosed

References