PT-2025-34960 · WordPress · Wp Ulike Pro

Wesley · Published 2025-08-28 · Updated 2025-08-28 · CVE-2024-9648

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WP ULike Pro versions prior to 1.9.4

Description: The WP ULike Pro plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation within the WP Ulike Pro File Uploader class. This allows unauthenticated attackers to upload arbitrary files, including .php2, .php6, .php7, .phps, .pht, .phtm, .pgif, .shtml, .phar, .inc, .hphp, .ctp, .module, .html, and .svg, to the server. Successful exploitation may enable further attacks, such as Cross-Site Scripting.

Recommendations: Update WP ULike Pro to version 1.9.4 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-9648

Affected Products

Wp Ulike Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-9648 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9b86d9ea-b842-4492-82e4-dd979fbe70cf?source=cve · Note
• https://t.me/CVEtracker/31095 · Telegram Post
• https://wpulike.com · Note
• https://twitter.com/VulmonFeeds/status/1960962572892393684 · Twitter Post
• https://t.me/cveNotify/133793 · Telegram Post
• https://twitter.com/CVEnew/status/1960912856901411063 · Twitter Post