CVE-2025-1309: UiPress Lite Privilege Escalation Flaw

CVE-2025-1309 Overview

CVE-2025-1309 is a privilege escalation vulnerability in the UiPress lite WordPress plugin, which provides custom dashboards, admin themes, and pages. The flaw resides in the uip_save_form_as_option() function, which lacks a capability check in all versions up to and including 3.5.04. Authenticated attackers with Subscriber-level access or higher can update arbitrary WordPress options. By modifying the default_role option to administrator and enabling the users_can_register option, attackers can register new accounts that automatically receive administrative privileges. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
A low-privileged Subscriber account can escalate to full WordPress administrator by tampering with site options, leading to complete site takeover.

Affected Products

UiPress lite plugin for WordPress, all versions up to and including 3.5.04
WordPress sites with open or accessible Subscriber-level registration
Multisite installations running the vulnerable plugin

Discovery Timeline

2025-03-07 - CVE-2025-1309 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-1309

Vulnerability Analysis

The vulnerability stems from the AJAX handler uip_save_form_as_option() registered in the plugin's admin core. The handler accepts user-supplied input and writes it directly to a WordPress option through update_option() without verifying the caller's capabilities. WordPress treats any authenticated user including Subscribers as eligible to invoke the wp_ajax_ action because no current_user_can() check gates the request. Attackers leverage this to overwrite security-critical options such as default_role and users_can_register. The vulnerable code can be reviewed in the UiPress lite AJAX functions file.

Root Cause

The root cause is a missing authorization check ([CWE-862]). The function relies solely on a nonce or authenticated session but never enforces a capability such as manage_options. Any authenticated session can pass the nonce by retrieving it from a logged-in page, leaving option modification fully exposed.

Attack Vector

An attacker registers or obtains a Subscriber account on the target site. The attacker then sends a crafted AJAX POST request to admin-ajax.php invoking the uip_save_form_as_option action with parameters that overwrite the default_role option to administrator and users_can_register to 1. After registering a new account through the public registration form, the attacker logs in with full administrator privileges. The Wordfence advisory documents the request flow in detail in the Wordfence vulnerability report.

Detection Methods for CVE-2025-1309

Indicators of Compromise

Unexpected changes to the default_role option set to administrator in wp_options
The users_can_register option toggled to 1 without an administrator action
New WordPress administrator accounts created shortly after a Subscriber account login
POST requests to /wp-admin/admin-ajax.php with action=uip_save_form_as_option from non-admin sessions

Detection Strategies

Monitor web server logs for admin-ajax.php requests containing the uip_save_form_as_option action originating from low-privileged users
Audit the wp_options table periodically for drift in default_role, users_can_register, siteurl, and home
Alert on creation of new administrator accounts that did not originate from an existing admin session

Monitoring Recommendations

Enable WordPress audit logging plugins to record option changes and user role assignments
Forward web server and PHP-FPM logs to a central SIEM and correlate authentication events with option modification events
Track plugin version inventory across managed WordPress sites and flag any instance of UiPress lite at version 3.5.04 or earlier

How to Mitigate CVE-2025-1309

Immediate Actions Required

Update UiPress lite to a version above 3.5.04 that includes the fix from WordPress Changeset #3249865
Audit all user accounts and remove any unauthorized administrator users
Reset default_role to subscriber and verify users_can_register matches the intended configuration
Rotate credentials and secret keys defined in wp-config.php if compromise is suspected

Patch Information

The vendor addressed the issue by adding a capability check to the uip_save_form_as_option() AJAX handler. The fix is committed in WordPress Changeset #3249865. Site operators should upgrade to the patched release through the WordPress plugin updater or by replacing the plugin directory with the patched version.

Workarounds

Deactivate and remove the UiPress lite plugin until the patched version can be applied
Disable open user registration by setting users_can_register to 0 in WordPress general settings
Restrict access to /wp-admin/admin-ajax.php for unauthenticated and Subscriber-level requests using a web application firewall rule that blocks the uip_save_form_as_option action

bash

# Example WP-CLI commands to restore safe defaults and remove the vulnerable plugin
wp option update default_role subscriber
wp option update users_can_register 0
wp plugin deactivate uipress-lite
wp plugin delete uipress-lite