CVE-2024-9648

The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class in all versions up to, and including, 1.9.3. This makes it possible for unauthenticated attackers to upload limited arbitrary files like .php2, .php6, .php7, .phps, .pht, .phtm, .pgif, .shtml, .phar, .inc, .hphp, .ctp, .module, .html, .svg on the affected site's server which may make make other attacks like Cross-Site Scripting possible. Only versions up to 1.8.7 were confirmed vulnerable, however, the earliest tested version for a patch we have access to is 1.9.4, so we are considering 1.9.4 the patched version.

• CWE-434

• https://wpulike.com/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9b86d9ea-b842-4492-82e4-dd979fbe70cf?source=cve

Published

Aug 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9641The LuckyWP Table of Contents WordPress plugin before 2.1.7 …4.8
• CVE-2024-9642The Editor Custom Color Palette plugin for WordPress is vuln…6.4
• CVE-2024-9643The Four-Faith F3x36 router using firmware v2.0.0 is vulnera…9.8
• CVE-2024-9644The Four-Faith F3x36 router using firmware v2.0.0 is vulnera…9.8
• CVE-2024-9645The Post Grid, Posts Slider, Posts Carousel, Post Filter, Po…5.4
• CVE-2024-9647The Kama SpamBlock plugin for WordPress is vulnerable to Ref…6.1
• CVE-2024-9649The WP ULike – The Ultimate Engagement Toolkit for Websites …4.3
• CVE-2024-9650The WP Recipe Maker plugin for WordPress is vulnerable to St…5.4
• CVE-2024-9651The Fluent Forms WordPress plugin before 5.2.1 does not san…6.1
• CVE-2024-9652The Locatoraid Store Locator plugin for WordPress is vulnera…6.1
• CVE-2024-9653The Restaurant Menu – Food Ordering System – Table Reservati…6.1
• CVE-2024-9654The Easy Digital Downloads plugin for WordPress is vulnerabl…3.7