CVE-2026-2294 is an improper authorization vulnerability (CWE-285) in the UiPress lite WordPress plugin (admintwentytwenty project). The issue arises from the absence of a capability check in the 'uip_save_global_settings' function, enabling authenticated users with low privileges (Subscriber or above) to change arbitrary plugin settings. This vulnerability affects all versions up to and including 3.5.09. The CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting network attack vector, low attack complexity, and limited privileges required, with impact on integrity only.

An attacker with Subscriber-level access or higher can modify plugin settings without proper authorization, potentially altering the behavior or configuration of the UiPress lite plugin. This impacts the integrity of plugin data but does not affect confidentiality or availability. There are no known exploits in the wild, and the vulnerability does not allow privilege escalation beyond the attacker's existing access level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only. Monitor for updates from the plugin vendor or WordPress security channels regarding patches or temporary mitigations.