CVE-2025-3921: PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handelajaxreq() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata which can be leveraged to block an administrator from accessing their site when wpcapabilities is set to 0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3921?
CVE-2025-3921 is a medium severity vulnerability that allows unauthorized modification of user data.
How do I fix CVE-2025-3921?
To fix CVE-2025-3921, update the PeproDev Ultimate Profile Solutions plugin to version 7.5.3 or later.
Which versions of PeproDev Ultimate Profile Solutions are affected by CVE-2025-3921?
CVE-2025-3921 affects PeproDev Ultimate Profile Solutions versions from 1.9.1 to 7.5.2.
Can CVE-2025-3921 be exploited by authenticated users?
CVE-2025-3921 can be exploited by unauthenticated users, making it particularly concerning.
What types of attacks can CVE-2025-3921 enable?
CVE-2025-3921 can enable attackers to update arbitrary user data without authorization.