CVE-2025-1309: 
WordPress vulnerability analysis and mitigation

The UiPress lite WordPress plugin (versions up to 3.5.04) contains a vulnerability identified as CVE-2025-1309. This security flaw stems from a missing capability check in the uip_save_form_as_option() function, which was discovered and reported on March 7, 2025 (NVD).

The vulnerability is characterized by a missing authorization check (CWE-862) in the uip_save_form_as_option() function. It has received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to update arbitrary options on the WordPress site. This can be exploited to modify the default role for registration to administrator and enable user registration, ultimately leading to unauthorized administrative access to the vulnerable site (NVD).

The vulnerability requires an authenticated user with at least Subscriber-level privileges to exploit. The attack complexity is rated as low, requiring no user interaction and can be executed remotely over the network (NVD).

The vulnerability affects all versions of UiPress lite up to and including version 3.5.04. Users should update to a patched version when available (NVD).