{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "WP ULike Pro",
          "vendor": "WP Ulike",
          "versions": [
            {
              "lessThanOrEqual": "1.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@wordfence.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class in all versions up to, and including, 1.9.3. This makes it possible for unauthenticated attackers to upload limited arbitrary files like .php2, .php6, .php7, .phps, .pht, .phtm, .pgif, .shtml, .phar, .inc, .hphp, .ctp, .module, .html, .svg on the affected site\u0027s server which may make make other attacks like Cross-Site Scripting possible. Only versions up to 1.8.7 were confirmed vulnerable, however, the earliest tested version for a patch we have access to is 1.9.4, so we are considering 1.9.4 the patched version."
    },
    {
      "lang": "es",
      "value": "El plugin WP ULike Pro para WordPress es vulnerable a cargas de archivos arbitrarios debido a una validaci\u00f3n insuficiente del tipo de archivo en la clase WP_Ulike_Pro_File_Uploader en todas las versiones hasta la 1.9.3, inclusive. Esto hace posible que atacantes no autenticados carguen archivos arbitrarios limitados como .php2, .php6, .php7, .phps, .pht, .phtm, .pgif, .shtml, .phar, .inc, .hphp, .ctp, .module, .html, .svg en el servidor del sitio afectado, lo que puede hacer posibles otros ataques como Cross-Site Scripting. Solo las versiones hasta la 1.8.7 fueron confirmadas como vulnerables; sin embargo, la versi\u00f3n m\u00e1s antigua probada para un parche a la que tenemos acceso es la 1.9.4, por lo que consideramos la 1.9.4 como la versi\u00f3n con el parche."
    }
  ],
  "id": "CVE-2024-9648",
  "lastModified": "2026-09-26T21:10:00.130",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security@wordfence.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9648",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-08-28T13:37:14.762350Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-08-28T04:15:41.240",
  "references": [
    {
      "source": "security@wordfence.com",
      "url": "https://wpulike.com/"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b86d9ea-b842-4492-82e4-dd979fbe70cf?source=cve"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "security@wordfence.com",
      "type": "Secondary"
    }
  ]
}