CVE-2024-9649

The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7.4. This is due to missing or incorrect nonce validation on the wp_ulike_delete_history_api() function. This makes it possible for unauthenticated attackers to delete engagements via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://github.com/WordpressPluginDirectory/wp-ulike/blob/fd5eb54948cc1af9c348530a3cbd89c5a4bc68d0/wp-ulike/admin/admin-ajax.php#L78-L100Product
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168233%40wp-ulike&new=3168233%40wp-ulike&sfp_email=&sfph_mail=#file0Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3fcb35f8-ed88-4440-8cdf-95c1f0028253?source=cveThird Party Advisory

Published

Oct 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9642The Editor Custom Color Palette plugin for WordPress is vuln…6.4
• CVE-2024-9643The Four-Faith F3x36 router using firmware v2.0.0 is vulnera…9.8
• CVE-2024-9644The Four-Faith F3x36 router using firmware v2.0.0 is vulnera…9.8
• CVE-2024-9645The Post Grid, Posts Slider, Posts Carousel, Post Filter, Po…5.4
• CVE-2024-9647The Kama SpamBlock plugin for WordPress is vulnerable to Ref…6.1
• CVE-2024-9648The WP ULike Pro plugin for WordPress is vulnerable to arbit…6.1
• CVE-2024-9650The WP Recipe Maker plugin for WordPress is vulnerable to St…5.4
• CVE-2024-9651The Fluent Forms WordPress plugin before 5.2.1 does not san…6.1
• CVE-2024-9652The Locatoraid Store Locator plugin for WordPress is vulnera…6.1
• CVE-2024-9653The Restaurant Menu – Food Ordering System – Table Reservati…6.1
• CVE-2024-9654The Easy Digital Downloads plugin for WordPress is vulnerabl…3.7
• CVE-2024-9655The Gutenberg Blocks with AI by Kadence WP – Page Builder Fe…5.4