UiPress Lite Missing Authorization Vulnerability in WordPress Plugin

A vulnerability exists in the UiPress Lite WordPress plugin, specifically in versions through 3.5.08. The issue arises from a lack of proper capability checks in the 'uip_save_site_option()' function, allowing authenticated attackers with Subscriber-level access or higher to unauthorizedly modify plugin settings. This vulnerability also extends to other affected AJAX actions.

Impact

Exploitation of this vulnerability allows for unauthorized modification of plugin settings by authenticated users with Subscriber-level access and above.

Remediation

Users can update to version 3.5.09 or a newer patched version to address this vulnerability.