The UiPress lite plugin for WordPress suffers from an improper authorization vulnerability (CWE-285) caused by a missing capability check in the uip_save_site_option() function. This flaw allows authenticated users with low privileges (Subscriber-level and above) to change arbitrary plugin settings, potentially impacting site configuration. The issue affects all versions up to and including 3.5.08 and extends to other AJAX actions. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. No patch or vendor advisory is currently available.

An attacker with Subscriber-level access or higher can modify plugin settings without proper authorization, which may lead to unauthorized changes in site configuration. The vulnerability does not directly impact confidentiality or availability but allows integrity modification of plugin data. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for unusual changes in plugin settings. Avoid granting Subscriber-level access to untrusted users. Follow vendor updates for an official fix.