CVE-2026-0909 PUBLISHED

WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter

Assigner: Wordfence
Reserved: 13.01.2026 Published: 03.02.2026 Updated: 03.02.2026

The WP ULike plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.3.1. This is due to the wp_ulike_delete_history_api AJAX action not verifying that the log entry being deleted belongs to the current user. This makes it possible for authenticated attackers, with Subscriber-level access and above (granted the 'stats' capability is assigned to their role), to delete arbitrary log entries belonging to other users via the 'id' parameter.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 5.3

Product Status

Vendor alimir
Product WP ULike – Engagement Analytics & Interactive Buttons to Understand Your Audience
Versions Default: unaffected
  • affected from * to 4.8.3.1 (incl.)

Credits

  • Pouria Shahba finder

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE