CVE-2025-3921: PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function
First published: Wed May 07 2025(Updated: )
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PeproDev Ultimate Profile Solutions | >=1.9.1<=7.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3921?
CVE-2025-3921 is a medium severity vulnerability that allows unauthorized modification of user data.
How do I fix CVE-2025-3921?
To fix CVE-2025-3921, update the PeproDev Ultimate Profile Solutions plugin to version 7.5.3 or later.
Which versions of PeproDev Ultimate Profile Solutions are affected by CVE-2025-3921?
CVE-2025-3921 affects PeproDev Ultimate Profile Solutions versions from 1.9.1 to 7.5.2.
Can CVE-2025-3921 be exploited by authenticated users?
CVE-2025-3921 can be exploited by unauthenticated users, making it particularly concerning.
What types of attacks can CVE-2025-3921 enable?
CVE-2025-3921 can enable attackers to update arbitrary user data without authorization.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/peprodev
- canonical/peprodev ultimate profile solutions