CVE-2025-10938
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-11-21

Assigner: Wordfence

Description
The UiPress lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.08. This is due to missing capability checks in the 'uip_process_block_query' AJAX function. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive user data including password hashes, emails, and other user information that could be used for account takeover attacks.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-21
Last Modified
2025-11-21
Generated
2026-06-16
AI Q&A
2025-11-21
EPSS Evaluated
2026-06-15
NVD
CVE-2025-10938
EUVD
EUVD-2025-198422
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wordpress ui_press_lite *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in the UiPress lite plugin for WordPress allows authenticated users with subscriber-level access or higher to exploit missing capability checks in the 'uip_process_block_query' AJAX function. This flaw enables them to extract sensitive user data such as password hashes, emails, and other user information.

Impact Analysis

This vulnerability can lead to sensitive information exposure, allowing attackers to obtain password hashes, emails, and other user data. Such information could be used to perform account takeover attacks, compromising user accounts and potentially leading to unauthorized access to the affected WordPress site.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-10938. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart