UiPress Lite WordPress Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the UiPress Lite WordPress plugin, specifically in versions 3.5.07 and prior. The issue arises in the uip_process_form_input() function, which executes user-supplied functions with arbitrary data without proper capability checks. This vulnerability allows authenticated attackers with Subscriber-level access or higher to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.

Remediation

Users are advised to update the UiPress Lite WordPress plugin to version 3.5.08 or a newer patched version.