CVE-2024-9648

Vulnerability

Overview

The WP ULike Pro plugin [1] for WordPress contains an arbitrary file upload vulnerability in the WP_Ulike_Pro_File_Uploader class due to insufficient file type validation. This affects all versions up to and including 1.9.3, though only versions up to 1.8.7 have been confirmed vulnerable. The flaw allows unauthenticated attackers to upload files with extensions such as .php2, .php6, .php7, .phps, .pht, .phtm, .pgif, .shtml, .phar, .inc, .hphp, .ctp, .module, .html, and .svg.

Exploitation

An unauthenticated attacker can exploit this by sending a crafted file upload request to the vulnerable endpoint. No authentication or special privileges are required. The uploaded file types are limited but include .html and .svg, which can be used to inject malicious scripts. Other extensions like .phar or .shtml may be leveraged if the server is misconfigured to execute them.

Impact

Successful exploitation allows an attacker to store arbitrary HTML or SVG files on the server, leading to stored Cross-Site Scripting (XSS) attacks when other users view the uploaded content. In some server configurations, the uploaded files could potentially be executed, leading to more severe consequences such as remote code execution.

Mitigation

The vulnerability is patched in version 1.9.4. Users are strongly advised to update to the latest version immediately. No workarounds have been provided by the vendor.