The UiPress lite plugin for WordPress suffers from a missing authorization (CWE-862) vulnerability in the 'uip_save_ui_template' function. This flaw allows authenticated users with low privileges (Subscriber-level and above) to save templates that include custom JavaScript code, potentially enabling unauthorized data modification. The vulnerability affects all versions up to 3.5.08. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

An attacker with Subscriber-level access or higher can exploit this vulnerability to save templates containing arbitrary JavaScript code, which may lead to unauthorized modification of data within the plugin's scope. The impact includes partial loss of confidentiality and integrity but no impact on availability. This could facilitate further attacks depending on the environment and usage of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor plugin updates closely. Avoid granting Subscriber-level or higher access to untrusted users to reduce risk.