UiPress Lite Missing Authorization Vulnerability Leading to Privilege Escalation

A vulnerability exists in the UiPress Lite WordPress plugin, specifically in versions through 3.5.04. The issue arises from a lack of proper capability checks in the 'uip_save_form_as_option()' function, allowing authenticated users with Subscriber-level access or higher to modify arbitrary options on the WordPress site. This vulnerability can be exploited to change the default role for new users to administrator and enable user registration, potentially granting administrative access to the attacker.

Impact

Exploitation of this vulnerability allows for unauthorized modification of WordPress site options, which can lead to privilege escalation by changing user roles to administrator.

Remediation

Users are advised to update the UiPress Lite plugin to version 3.5.05 or later.