CVE-2024-1797: WP ULike WordPress Plugin SQLi Vulnerability

CVE-2024-1797 Overview

The WP ULike WordPress plugin contains a SQL Injection vulnerability in the wp_ulike_counter and wp_ulike shortcodes. The flaw affects all versions up to and including 4.6.9. Attackers can inject malicious SQL through the status and id attributes of these shortcodes. Exploitation requires authenticated access at the contributor level or above. Successful attacks allow adversaries to append arbitrary queries to existing statements and extract sensitive data from the WordPress database. The vulnerability maps to [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers with contributor-level access can execute arbitrary SQL queries against the WordPress database, exposing credentials, session data, and other stored information.

Affected Products

WP ULike – Most Advanced WordPress Marketing Toolkit plugin
All versions up to and including 4.6.9
WordPress installations using vulnerable wp_ulike_counter or wp_ulike shortcodes

Discovery Timeline

2024-05-02 - CVE-2024-1797 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1797

Vulnerability Analysis

The WP ULike plugin exposes two shortcodes, wp_ulike_counter and wp_ulike, that accept user-supplied status and id attributes. The plugin passes these attribute values into SQL queries without adequate escaping or parameterized preparation. Attackers with contributor privileges can embed the vulnerable shortcodes into posts and pass crafted values that break out of the intended query context. The injected SQL executes with the database privileges of the WordPress application user. This exposes user tables, credential hashes, session tokens, and any additional data stored in the WordPress database.

Root Cause

The root cause is insufficient input sanitization combined with unprepared SQL statement construction. The plugin concatenates the status and id shortcode attributes directly into SQL query strings instead of using the wpdb->prepare() parameterized query mechanism provided by WordPress. This bypasses standard defenses against SQL injection [CWE-89].

Attack Vector

An authenticated attacker with contributor-level access or above authors a post containing the vulnerable shortcode. The attacker sets the status or id attribute to a payload containing SQL syntax such as a UNION SELECT clause. When the shortcode renders, the malicious SQL executes against the WordPress database and returns data controlled by the attacker's query. The attack does not require user interaction beyond triggering the render path.

Refer to the Wordfence Vulnerability Analysis for additional technical detail on the injection points.

Detection Methods for CVE-2024-1797

Indicators of Compromise

Unexpected wp_ulike_counter or wp_ulike shortcodes in posts authored by contributor-level accounts
Post revisions containing SQL syntax such as UNION, SELECT, SLEEP, or -- within shortcode attribute values
Anomalous query patterns in MySQL slow query or general logs referencing the wp_ulike tables
Outbound data transfers correlating with post preview or render events

Detection Strategies

Audit the wp_posts and wp_postmeta tables for shortcode content containing suspicious characters in the status or id attributes
Enable MySQL query logging and alert on multi-statement queries or UNION operators originating from WordPress
Monitor WordPress access logs for contributor accounts triggering preview=true requests immediately after post creation
Deploy a Web Application Firewall rule that inspects shortcode attribute values for SQL metacharacters

Monitoring Recommendations

Track the plugin version reported by wp plugin list against the fixed release across all WordPress hosts
Alert on new contributor or author account creation followed by rapid post authoring activity
Correlate database error responses with authenticated session identifiers to identify probing attempts
Baseline normal WP ULike query volume and flag deviations that suggest injection attempts

How to Mitigate CVE-2024-1797

Immediate Actions Required

Update the WP ULike plugin to a version above 4.6.9 on all WordPress installations
Audit contributor, author, and editor accounts and remove any that are unrecognized or inactive
Review recently created or modified posts for injected wp_ulike_counter or wp_ulike shortcodes
Rotate WordPress administrator passwords and database credentials if compromise is suspected

Patch Information

The vendor addressed the vulnerability in a subsequent release. Details of the code fix are available in the WordPress Plugin Changeset. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Deactivate the WP ULike plugin until the patched version is deployed
Restrict contributor and author role assignments to trusted users only
Deploy a WAF rule blocking SQL metacharacters in shortcode attribute POST parameters
Disable shortcode execution in posts authored by lower-privileged roles where feasible

bash

# Update WP ULike using WP-CLI
wp plugin update wp-ulike --version=latest

# Verify installed version
wp plugin get wp-ulike --field=version

# Temporary mitigation: deactivate the plugin
wp plugin deactivate wp-ulike