The UiPress lite plugin for WordPress suffers from a missing authorization (CWE-862) vulnerability in the 'uip_process_block_query' AJAX function. This flaw allows authenticated users with low privileges (subscriber-level and above) to bypass capability checks and retrieve sensitive user information including password hashes and emails. The vulnerability affects all versions up to and including 3.5.08. It is classified with a CVSS 3.1 base score of 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required. No known exploits are reported in the wild, and no patch or official remediation guidance has been provided yet.

An attacker with subscriber-level access or higher can extract sensitive user data such as password hashes and emails due to missing authorization checks. This information exposure increases the risk of account takeover attacks. The vulnerability does not affect availability or integrity but compromises confidentiality of user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the UiPress lite plugin. Avoid granting unnecessary privileges to users. Follow updates from the plugin vendor for official patches or workarounds.