CVE-2025-10938
UiPress lite <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information ExposureThe UiPress lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.08. This is due to missing capability checks in the 'uip_process_block_query' AJAX function. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive user data including password hashes, emails, and other user information that could be used for account takeover attacks.
We have discovered 5 live websites that are affected by CVE-2025-10938.
Affected Software
| Product |  Uipress Lite |
| Category | Wordpress Plugins |
| Vulnerable Domains | 5 live websites (63% of Uipress Lite install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 1 versions ( 50% of all versions) |
Common Weakness Enumeration
CWE-862 Missing AuthorizationDetails
- Published - Nov 21, 2025
- Updated - Apr 8, 2026
Credits
- abrahack (finder)
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2025-10938 United States | 1 websites |
 Brazil | 1 websites |
 Finland | 1 websites |
 GB | 1 websites |
 Thailand | 1 websites |
Website Distribution by TLD
Number of websites using CVE-2025-10938| .com | 3 websites |
| .com.br | 1 websites |
| .fi | 1 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2025-10938
Top websites that are affected by CVE-2025-10938. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| *************.***.br | Brazil | **,***,*** | |
| **********.com | Thailand | **,***,*** | |
| *****.fi | Finland | **,***,*** | |
| **.********.com | GB | **,***,*** | |
| *****.com | United States | ***,***,*** |
FAQ
CVE-2025-10938 is Missing Authorization in Uipress Lite
A total of 5 websites have been identified as vulnerable to CVE-2025-10938, based on global website indexing conducted by WebTechSurvey.
The Uipress Lite is affected by the CVE-2025-10938 vulnerability.
Uipress Lite versions up to and including 3.5.8 are vulnerable to CVE-2025-10938.