Arbitrary File Upload Vulnerability in WP ULike Pro Plugin for WordPress
CVE-2024-9648

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
WP Ulike Pro
Vendor
CVE Published:
28 August 2025

What is CVE-2024-9648?

The WP ULike Pro plugin for WordPress has a critical vulnerability that allows unauthenticated attackers to upload arbitrary files due to insufficient validation of file types in the WP_Ulike_Pro_File_Uploader class. This issue affects all versions up to and including 1.9.3. Attackers can exploit this vulnerability to upload potentially malicious file types such as .php2, .html, .svg, and others, enabling further attacks like Cross-Site Scripting (XSS). It is crucial for users to update to version 1.9.4 or later to mitigate this risk.

Affected Version(s)

WP ULike Pro * <= 1.9.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wpulike.com/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wesley
.