High severity8.2NVD Advisory· Published May 7, 2025· Updated Apr 15, 2026

CVE-2025-3921

Description

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Peprodev Upsreferences
Package: https://wordpress.org/plugins/peprodev-ups
Pepro Dev. Group/PeproDev Ultimate Profile Solutionsllm-create
Range: >=1.9.1, <=7.5.2

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.phpnvd
wordpress.org/plugins/peprodev-ups/nvd
www.wordfence.com/threat-intel/vulnerabilities/id/a881ca02-cef9-4f4b-8a62-e241c4c80004nvd

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000