CVE-2025-1309: 
WordPress vulnerability analysis and mitigation

The UiPress lite WordPress plugin (versions up to 3.5.04) contains a vulnerability identified as CVE-2025-1309. This security flaw stems from a missing capability check in the uipsaveformasoption() function, which was discovered and reported on March 7, 2025 (NVD).

The vulnerability is characterized by a missing authorization check (CWE-862) in the uipsaveformasoption() function. It has received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to update arbitrary options on the WordPress site. This can be exploited to modify the default role for registration to administrator and enable user registration, ultimately leading to unauthorized administrative access to the vulnerable site (NVD).

The vulnerability affects all versions of UiPress lite up to and including version 3.5.04. Users should update to a patched version when available (NVD).