CVE-2025-1309 is a critical authorization bypass vulnerability in the UiPress lite WordPress plugin, which provides custom dashboards, admin themes, and pages. The vulnerability stems from the absence of a capability check in the uip_save_form_as_option() function, allowing authenticated users with minimal privileges (Subscriber-level or above) to update arbitrary WordPress options. This unauthorized modification can be exploited to change the default user role assigned upon registration to 'administrator' and to enable user registration if it was previously disabled. Consequently, an attacker can create new administrative accounts, gaining full control over the WordPress site. The vulnerability affects all versions up to 3.5.04 inclusive. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, privileges required but no user interaction, and impacts on confidentiality, integrity, and availability. No patches are currently linked, and no known exploits have been observed in the wild. The vulnerability is classified under CWE-862 (Missing Authorization). Given WordPress's widespread use and the popularity of UiPress lite for admin customization, this vulnerability poses a significant risk to many websites globally.

The impact of CVE-2025-1309 is severe for organizations running WordPress sites with the UiPress lite plugin installed. Attackers with low-level authenticated access can escalate privileges to full administrator rights, effectively taking over the site. This can lead to complete loss of confidentiality, integrity, and availability of the affected WordPress installation. Attackers could install backdoors, deface websites, steal sensitive data, or use the compromised site as a launchpad for further attacks. The ability to enable user registration and assign admin roles increases the risk of persistent and stealthy compromises. Organizations relying on WordPress for business operations, e-commerce, or content management face reputational damage, financial loss, and regulatory compliance issues if exploited. The vulnerability's ease of exploitation and broad impact make it a critical threat to websites globally.

To mitigate CVE-2025-1309, organizations should immediately update the UiPress lite plugin to a patched version once available. Until a patch is released, administrators should consider disabling or uninstalling the plugin to eliminate the attack surface. Restricting user roles and minimizing the number of users with Subscriber-level access can reduce risk. Implementing Web Application Firewalls (WAFs) with custom rules to detect and block suspicious requests targeting the uip_save_form_as_option() function may provide temporary protection. Monitoring WordPress site options for unauthorized changes, especially the default user role and registration settings, can help detect exploitation attempts. Additionally, enforcing strong authentication mechanisms and regularly auditing user accounts for unauthorized admin users will help contain potential damage. Organizations should also review their WordPress security posture, including plugin inventories and access controls, to prevent similar vulnerabilities.