Unauthenticated attackers can delete engagements via forged requests
CVE-2024-9649
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 16 October 2024
What is CVE-2024-9649?
The WP ULike plugin for WordPress contains a Cross-Site Request Forgery vulnerability that affects all versions up to and including 4.7.4. This issue arises from missing or incorrect nonce validation within the wp_ulike_delete_history_api() function. As a result, unauthenticated attackers may exploit this vulnerability to delete user engagements, provided they can deceive an administrator into executing a specific action, such as clicking on a malicious link. It is essential for WordPress site owners using this plugin to take immediate steps to mitigate the risk associated with this vulnerability.
Affected Version(s)
WP ULike – All-in-One Engagement Toolkit * <= 4.7.4