CVE-2025-3053: UiPress WordPress Plugin RCE Vulnerability

CVE-2025-3053 Overview

CVE-2025-3053 is a Remote Code Execution vulnerability in the UiPress lite WordPress plugin, which provides custom dashboards, admin themes, and pages. The flaw affects all versions up to and including 3.5.07. The uip_process_form_input() function accepts user-supplied input to invoke arbitrary functions with arbitrary arguments and lacks any capability check. Authenticated attackers with Subscriber-level access or higher can execute arbitrary code on the underlying server. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Subscriber-level authenticated users can execute arbitrary code on the WordPress server, leading to full site compromise.

Affected Products

UiPress lite plugin for WordPress, all versions through 3.5.07
WordPress sites allowing Subscriber-level or higher registration
Sites using the uip_process_form_input() AJAX handler

Discovery Timeline

2025-05-15 - CVE-2025-3053 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3053

Vulnerability Analysis

The vulnerability resides in the uip_process_form_input() function within the plugin's AJAX handler at admin/core/ajax-functions.php. The function dispatches to internal handlers based on user-controlled parameters submitted through the AJAX endpoint. Because the dispatcher accepts the target function name and arguments from request data, an attacker can direct the plugin to invoke arbitrary functions with attacker-chosen inputs.

The code path executes without verifying the caller's WordPress capabilities. Any authenticated session, including a Subscriber account created through open registration, satisfies the nonce and authentication checks the handler enforces. The result is server-side code execution under the privileges of the WordPress PHP process.

Root Cause

The root cause is missing authorization combined with unsafe dynamic dispatch. The handler trusts client-supplied parameters to select which function to execute and what data to pass. There is no allow-list of permitted handlers and no current_user_can() capability check restricting the action to administrators.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session at Subscriber level or above. The attacker submits a crafted AJAX POST request to the plugin's endpoint, specifying the target function and parameters. The vulnerable handler invokes the function, enabling arbitrary code execution, file writes, or modification of WordPress configuration. Refer to the Wordfence Vulnerability Report and the WordPress Change Log Entry for the corrected dispatcher logic. EPSS data places exploitation likelihood at the 83rd percentile.

// Conceptual request shape (illustrative, not verified PoC)
// POST /wp-admin/admin-ajax.php
// action=uip_process_form_input
// target_function=<attacker_chosen>
// arguments[]=<attacker_data>

Detection Methods for CVE-2025-3053

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with action=uip_process_form_input from Subscriber accounts
New or modified PHP files under wp-content/uploads/ or plugin directories following AJAX activity
Creation of WordPress administrator accounts shortly after Subscriber-level logins
Outbound connections from the web server to unfamiliar hosts following plugin AJAX calls

Detection Strategies

Monitor WordPress access logs for high-frequency uip_process_form_input actions originating from low-privilege accounts
Inspect AJAX request bodies for suspicious function names being passed as parameters
Alert on PHP process spawning system shells, curl, wget, or compiler binaries on WordPress hosts
Compare installed plugin file hashes against the official 3.5.08 or later release

Monitoring Recommendations

Enable verbose logging of admin-ajax.php requests with full POST body capture in a WAF or reverse proxy
Track new user registrations and immediate AJAX activity from those accounts
Forward web server, PHP error, and WordPress audit logs to a centralized SIEM for correlation

How to Mitigate CVE-2025-3053

Immediate Actions Required

Update UiPress lite to a version newer than 3.5.07 as soon as the patched release is available
Disable open user registration or restrict default role to a non-functional value until patched
Audit existing Subscriber accounts and remove unrecognized users
Review web server and WordPress audit logs for prior exploitation attempts against uip_process_form_input

Patch Information

The fix is committed in changeset 3292552 to the plugin trunk, which adds capability checks and restricts the dispatcher in admin/core/ajax-functions.php. See the WordPress Change Log Entry for the corrected code.

Workarounds

Deactivate and remove the UiPress lite plugin until a patched version is installed
Block requests to admin-ajax.php with action=uip_process_form_input at the WAF for non-administrator sessions
Set define('DISALLOW_FILE_MODS', true); in wp-config.php to limit downstream file-write impact

bash

# Block the vulnerable AJAX action at the web server (nginx example)
location = /wp-admin/admin-ajax.php {
    if ($request_body ~* "action=uip_process_form_input") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}