WordPress Plugin Vulnerabilities

WP ULike < 4.7.10 - Missing Authorization to Unauthenticated Content Spoofing

Description

The plugin is vulnerable to content spoofing due to a missing capability check on a function. This makes it possible for unauthenticated attackers to spoof content.

Affects Plugins

Plugin icon
wp-ulike
Fixed in 4.7.10

References

CVE
CVE-2025-32259
URL
https://patchstack.com/database/wordpress/plugin/wp-ulike/vulnerability/wordpress-wp-ulike-plugin-4-7-9-1-content-spoofing-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Robert DeVore
Verified
No
WPVDB ID
fbe87f3b-deaa-4899-9a53-06501819d4ad

Timeline

Publicly Published
2025-04-04 (about 1 year ago)
Added
2025-04-10 (about 1 year ago)
Last Updated
2025-08-19 (about 8 months ago)

Other

Published
Title
Published
2026-02-17
Title
EmailKit – Email Customizer for WooCommerce & WP < 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification
Published
2024-09-25
Title
Sunshine Photo Cart < 3.2.9 - Missing Authorization
Published
2025-12-04
Title
Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update
Published
2024-03-11
Title
Mollie Forms < 2.6.4 - Missing Authorization
Published
2024-03-13
Title
Accordion < 2.2.97 - Missing Authorization to Authenticated(Contributor+) Post Duplication