What is CVE-2025-3921?

CVE-2025-3921 is a high-severity vulnerability in Peprodev Ultimate Profile Solutions, classified under Improper Authorization. CVSS score: 8.2/10. Published 2025-05-07.

How severe is CVE-2025-3921?

High severity. CVSS v3 base score is 8.2 out of 10.

Auth bypass in Peprodev Ultimate Profile Solutions

CVE-2025-3921

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0.

EPSS: 0.004 (32.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L.

Affected products

Peprodev Ultimate Profile Solutions — versions 1.9.1

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

Frequently asked questions

What is CVE-2025-3921?: CVE-2025-3921 is a high-severity vulnerability in Peprodev Ultimate Profile Solutions, classified under Improper Authorization. CVSS score: 8.2/10. Published 2025-05-07.
How severe is CVE-2025-3921?: High severity. CVSS v3 base score is 8.2 out of 10.