What is the CVSS score of CVE-2026-2294?

CVE-2026-2294 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2294?

Organizations using all should be aware of moderate risk from CVE-2026-2294 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-2294?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-2294

EUVD-2026-13985 MEDIUM

Improper Authorization (CWE-285)

2026-03-21 Wordfence

GHSA-r2mm-9gj3-rpm5

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13985

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_global_settings' function in all versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings.

AnalysisAI

UiPress lite plugin for WordPress through version 3.5.09 fails to validate user permissions on the global settings modification function, allowing authenticated subscribers and higher-privileged users to arbitrarily alter plugin configurations. This insufficient access control enables attackers to modify sensitive settings despite lacking administrative rights. A patch is not currently available.

Technical ContextAI

The vulnerability exists in the UiPress Lite WordPress plugin (CPE: cpe:2.3:a:admintwentytwenty:uipress_lite_|_effortless_custom_dashboards,_admin_themes_and_pages), which provides custom dashboard and admin theme functionality. The root cause is classified under CWE-285 (Improper Authorization), specifically a missing capability check in the 'uip_save_global_settings' function referenced in the plugin's uiBuilder.php file at line 333. WordPress plugins use capability checks (such as 'current_user_can()' with appropriate admin capabilities like 'manage_options') to enforce role-based access control. The absence of such a check allows the AJAX handler or direct function call to execute without verifying that the caller possesses administrator privileges, relying instead only on the generic 'is_user_logged_in()' authentication. This enables any authenticated user—including those with minimal Subscriber role permissions—to invoke the settings modification function.

RemediationAI

Update the UiPress Lite plugin to a version released after 3.5.09; check the official WordPress plugin repository for the latest patched release. Immediately apply the update via WordPress dashboard (Plugins > Installed Plugins > UiPress Lite > Update if available) or manually re-download from plugins.trac.wordpress.org. As an interim workaround pending updates, restrict Subscriber and low-privilege user roles from accessing the WordPress admin dashboard by using capability-restriction plugins or custom role management, reducing the attack surface. Additionally, implement Web Application Firewall (WAF) rules to monitor and block unusual requests to admin-ajax.php endpoints related to 'uip_save_global_settings' from non-administrator sessions. Review audit logs to detect whether settings have been modified by unexpected low-privilege accounts. Monitor the Wordfence threat intelligence feed for active exploitation signals.