CVE-2025-10938

15th percentile - higher than 15% of all known CVEs

The UiPress lite plugin for WordPress in all versions up to and including 3.5.08 is vulnerable to Sensitive Information Exposure. This is due to missing capability checks in the 'uip_process_block_query' AJAX function. An authenticated attacker with subscriber-level access or above can extract sensitive user data including password hashes, emails, and other information that could be used for account takeover attacks.

A low-privileged attacker can obtain authentication data and other sensitive information, potentially leading to account takeover. The risk affects all WordPress sites with the vulnerable plugin version installed.

Update the UiPress lite plugin to a version newer than 3.5.08 or remove it if not in use. Additionally, consider reviewing user accounts and forcing password resets if exploitation is suspected.