CVE-2024-9649: WP ULike Plugin CSRF Vulnerability

CVE-2024-9649 Overview

The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 4.7.4. The flaw resides in the wp_ulike_delete_history_api() function, which lacks proper nonce validation. Unauthenticated attackers can craft malicious requests that delete engagement history when a site administrator is tricked into clicking a specially prepared link. The vulnerability is categorized under CWE-352: Cross-Site Request Forgery and impacts integrity of stored engagement data.

Critical Impact
Unauthenticated attackers can delete WP ULike engagement records through forged administrator requests, causing loss of user interaction data on affected WordPress sites.

Affected Products

WP ULike WordPress plugin versions up to and including 4.7.4
WordPress sites running the WP ULike – The Ultimate Engagement Toolkit
Any WordPress installation where an administrator can be induced to visit an attacker-controlled page

Discovery Timeline

2024-10-16 - CVE-2024-9649 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9649

Vulnerability Analysis

The vulnerability originates in the plugin's admin AJAX handler responsible for deleting engagement history. The wp_ulike_delete_history_api() function processes destructive requests without verifying a WordPress nonce token. WordPress nonces exist specifically to bind privileged actions to an authenticated user session, preventing off-site request forgery. Because the check is absent or incorrect, the server accepts any request that presents a valid administrator cookie, regardless of origin.

An attacker exploits this by hosting a page containing a hidden form or image tag that targets the plugin's AJAX endpoint. When a logged-in administrator visits the attacker's page, the browser automatically attaches session cookies, and the plugin executes the deletion. The attacker needs no credentials of their own — only user interaction from a privileged victim. The impact is limited to integrity loss on engagement history records; confidentiality and site availability are not directly affected.

Root Cause

The root cause is missing or incorrect nonce validation in the wp_ulike_delete_history_api() function inside admin/admin-ajax.php. WordPress provides check_ajax_referer() and wp_verify_nonce() helpers specifically to prevent this class of issue, and the affected code path does not enforce them correctly. Reviewers can inspect the pre-patch code in the wp-ulike GitHub source.

Attack Vector

Exploitation requires network access to the target WordPress site and user interaction from an authenticated administrator. The attacker delivers a malicious link through phishing, forum posts, comments, or embedded content on a compromised third-party site. When the administrator loads the crafted page while logged into WordPress, the browser silently submits a request to the vulnerable AJAX endpoint, and the plugin deletes the targeted engagement history. Fix details are visible in the WordPress Plugin Trac changeset.

No public exploit or proof-of-concept has been published. See the Wordfence Vulnerability Report for the vendor advisory.

Detection Methods for CVE-2024-9649

Indicators of Compromise

Unexpected deletions of records in WP ULike engagement tables such as wp_ulike, wp_ulike_comments, wp_ulike_activities, and wp_ulike_forums
POST requests to admin-ajax.php with the wp_ulike_delete_history_api action originating from external Referer headers
Administrator sessions generating engagement-deletion requests immediately after visiting an unfamiliar URL

Detection Strategies

Enable WordPress and web server access logging, then alert on admin-ajax.php requests whose Referer does not match the site's own domain
Correlate administrator authentication events with subsequent database write operations to WP ULike tables to surface anomalous deletion bursts
Deploy a web application firewall rule that inspects requests to the vulnerable AJAX action and blocks those lacking a valid nonce parameter

Monitoring Recommendations

Track the installed version of the WP ULike plugin across all managed WordPress instances and alert when it is at or below 4.7.4
Monitor administrator browsing telemetry for links to untrusted domains delivered via email, comments, or messaging platforms
Review WordPress audit logs weekly for bulk deletions in engagement history tables

How to Mitigate CVE-2024-9649

Immediate Actions Required

Upgrade the WP ULike plugin to a version later than 4.7.4 that includes the fix committed in changeset 3168233
Instruct WordPress administrators to log out of the admin panel before browsing untrusted sites or clicking unsolicited links
Restrict the WordPress admin area by IP allowlist or VPN to reduce the exposure surface of privileged sessions

Patch Information

The vendor addressed the issue in the plugin update referenced by the WordPress Plugin Trac changeset 3168233. The patch adds proper nonce validation to the wp_ulike_delete_history_api() handler so the endpoint rejects requests that do not present a valid, session-bound nonce token.

Workarounds

If the plugin cannot be updated immediately, deactivate WP ULike until the patched version is deployed
Add a web application firewall rule that blocks POST requests to admin-ajax.php where the action parameter equals wp_ulike_delete_history_api and no valid _wpnonce is present
Use a browser dedicated exclusively to WordPress administration and avoid browsing arbitrary web content in that session

bash

# Example ModSecurity rule to block unauthenticated CSRF attempts
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1009649,msg:'CVE-2024-9649 WP ULike CSRF attempt'"
    SecRule ARGS:action "@streq wp_ulike_delete_history_api" \
        "chain"
        SecRule &ARGS:_wpnonce "@eq 0"