Security Alert Summary
The WP ULike plugin contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to delete log entries belonging to other users. The issue stems from an AJAX action that does not verify ownership of the log entry being deleted, and can be triggered via the id parameter by users with Subscriber-level access and above if their role has the stats capability.
CVE Details
- CVE ID: CVE-2026-0909
- Affected plugin / component: WP ULike plugin for WordPress (AJAX delete history action)
- Affected versions: All versions up to and including 4.8.3.1
- Published: February 3, 2026, 4:15:56 AM UTC
- Last modified: February 3, 2026, 4:44:03 PM UTC
- CVSS v3.1: Base Score 5.3, Medium — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: CVSS metrics indicate
Privileges Required: NONEandUser Interaction: NONE. The CVE description states exploitation is possible by authenticated attackers with Subscriber-level access and above when the role has thestatscapability. - Primary impact: Integrity impact: Low. Confidentiality: None. Availability: None.
- CWE / weakness ID: CWE-639
Technical Details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the WP ULike plugin’s AJAX handling. Specifically, the wp_ulike_delete_history_api AJAX action does not verify that the log entry identified by the provided id parameter actually belongs to the current user. Because ownership is not checked, an authenticated user who can reach this AJAX endpoint and whose role has the stats capability can supply another user’s log entry ID and trigger deletion of that entry.
The root cause is a missing authorization check in the server-side handler for the delete-history action. The request is processed based on the supplied id without confirming the entry’s association with the requesting user, allowing deletion of arbitrary log records.
How This Could Impact Your Website
In a typical WordPress site with multiple users—such as a site owner, editorial staff, and external contributors—this issue could allow an attacker with a low-level account (Subscriber or higher, if the role has the stats capability) to remove log entries that belong to other users. Practical consequences include:
- Loss of audit records or user activity logs, making it harder to track who performed certain actions.
- Attackers could remove evidence of their own actions, complicating incident response and forensic review.
- Because logs may be used to detect suspicious behavior, removing entries can increase the time an attacker remains undetected and raise the risk of follow-on social engineering attacks.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (fixed version is not specified in the CVE entry).
- Review and reduce unnecessary user roles and capabilities; remove the
statscapability from roles that do not require it. - Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior or unexpected deletions of audit records.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wp-ulike/tags/4.8.3.1/admin/admin-ajax.php#L94
- https://plugins.trac.wordpress.org/browser/wp-ulike/trunk/admin/admin-ajax.php#L94
- https://plugins.trac.wordpress.org/changeset/3451296/wp-ulike/trunk/admin/admin-ajax.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bee2e520-46cc-4b54-9849-fafb9b37ba19?source=cve
