Executive brief
UiPress Lite is a WordPress plugin that enables users to create custom admin dashboards and themes. The plugin fails to properly verify user permissions when saving templates, allowing lower-privileged users (such as Subscribers) to inject malicious JavaScript code into dashboard templates that will execute with administrative privileges.
Technical details
The vulnerability is a missing capability check in the 'uip_save_ui_template' AJAX function, allowing unauthenticated privilege escalation. The plugin does not verify that the user has the required permissions before allowing template saves, enabling authenticated Subscriber-level users to craft templates containing custom JavaScript. The malicious script executes in the context of the WordPress admin interface when templates are rendered, potentially allowing attackers to modify plugin settings, create administrative accounts, or exfiltrate sensitive data. The vulnerability affects all versions up to 3.5.09. Patches are expected to introduce proper role-based capability checks on the vulnerable AJAX handler.
Affected products
- Uipress UiPress Lite up to 3.5.09
Timeline
- 2025-01-21: disclosed