CVE-2025-3921
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0.
| CWE | CWE-285 |
| Vendor | peprodev |
| Product | peprodev ultimate profile solutions |
| Published | May 7, 2025 |
| Last Updated | May 7, 2025 |
Stay Ahead of the Next One
Get instant alerts for peprodev peprodev ultimate profile solutions
Be the first to know when new high vulnerabilities affecting peprodev peprodev ultimate profile solutions are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
peprodev / PeproDev Ultimate Profile Solutions
1.9.1 ≤ 7.5.2
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/a881ca02-cef9-4f4b-8a62-e241c4c80004?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L1483 wordpress.org: https://wordpress.org/plugins/peprodev-ups/#developers
Credits
Kenneth Dunn