---
id: CVE-2025-10938
title: >-
  The UiPress lite plugin for WordPress is vulnerable to Sensitive Information
  Exposure in all versions up to, and including, 3.5.08
summary: >-
  The UiPress lite plugin for WordPress is vulnerable to Sensitive Information
  Exposure in all versions up to, and including, 3.5.08. This is due to missing
  capability checks in the 'uip_process_block_query' AJAX function. This makes
  it po…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: admintwentytwenty
product: 'UiPress lite | Effortless custom dashboards, admin themes and pages'
affected:
  - uipress_lite_effortless_custom_dashboards_admin_themes_and_pages <= 3.5.09
published: '2025-11-21'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:16:37.167'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-10938'
references:
  - url: 'https://plugins.trac.wordpress.org/changeset/3654103/'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/d8aa06eb-774a-4cd9-bd35-2d6409475696?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.00248
epssPercentile: 0.14322
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-11-21T14:48:01.742437Z'
ingestedAt: '2026-09-14T20:14:21.153Z'
---

## Overview

The UiPress lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.08. This is due to missing capability checks in the 'uip_process_block_query' AJAX function. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive user data including password hashes, emails, and other user information that could be used for account takeover attacks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.