Threats tagged 'ghsa-fq8w-f546-pvmw'

The UiPress lite WordPress plugin up to version 3.5.08 has a vulnerability due to a missing capability check in the uip_save_site_option() function. This flaw allows authenticated users with Subscriber-level access or higher to modify arbitrary plugin settings without proper authorization. Other AJAX actions in the plugin are also affected by similar issues. The vulnerability has a medium severity score of 4.3 and impacts the integrity of plugin settings but does not affect confidentiality or availability.