Vulnerability · Published May 7, 2025 · Assigned by Wordfence

CVE-2025-3921PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function

High 8.2

In plain English

A high-severity security flaw in PeproDev Ultimate Profile Solutions from peprodev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 60.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0.

Affected products (as reported)

Vendor	Product	Versions
peprodev	PeproDev Ultimate Profile Solutions	1.9.1 – through 7.5.2

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

In plain English

Official description

Affected products (as reported)

References