Sensitive Information Exposure in UiPress Lite Plugin for WordPress

CVE-2025-10938

What is CVE-2025-10938?

The UiPress Lite plugin for WordPress contains a vulnerability that allows authenticated users, including those with subscriber-level access, to access sensitive information. This issue arises from inadequate capability checks in the 'uip_process_block_query' AJAX function, which can potentially expose critical user data such as password hashes and emails. Attackers could exploit this to gain further access and potentially take over user accounts. It is crucial for users to ensure they are using updated versions of the plugin to mitigate the risks associated with this vulnerability.

References