CVE-2026-0909: 
WordPress vulnerability analysis and mitigation

CVE-2026-0909 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP ULike plugin for WordPress, affecting all versions up to and including 4.8.3.1. The flaw allows authenticated attackers with Subscriber-level access (or above, provided the 'stats' capability is assigned to their role) to delete arbitrary log entries belonging to other users. It was published on February 3, 2026, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Specifically, the wp_ulike_delete_history_api AJAX action in admin/admin-ajax.php does not verify that the log entry identified by the user-supplied id parameter belongs to the currently authenticated user. An attacker with at least Subscriber-level access and the 'stats' capability can send a crafted AJAX request with an arbitrary id value to delete any user's engagement log entry. The vulnerable code path is visible in the plugin's source at line 94 of admin/admin-ajax.php (Wordfence, WP Trac).

Successful exploitation allows an authenticated attacker to delete engagement/like history log entries belonging to any other user on the WordPress site, resulting in unauthorized data modification. The primary impact is on data integrity — attackers can manipulate analytics and engagement records tracked by the WP ULike plugin. There is no confidentiality or availability impact, and the scope is limited to the affected WordPress installation (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-0909. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication with at least Subscriber-level access and the 'stats' capability, which limits the attacker pool (Wordfence).

1. Obtain authenticated access: Register or obtain credentials for a WordPress account with at least Subscriber-level access on the target site, ensuring the 'stats' capability is assigned to the role.
2. Identify target log entry IDs: Browse or interact with the WP ULike plugin to observe log entry IDs, or enumerate them by sending test AJAX requests and observing responses.
3. Craft malicious AJAX request: Send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action set to wp_ulike_delete_history_api and the id parameter set to the target log entry ID belonging to another user.
4. Delete arbitrary log entries: Because the plugin does not verify ownership of the log entry, the server processes the deletion request and removes the targeted entry from the database, regardless of which user it belongs to (Wordfence, WP Trac).

• Logs: WordPress access logs showing repeated POST requests to /wp-admin/admin-ajax.php with action=wp_ulike_delete_history_api and varying id parameter values from a single authenticated user account.
• Database: Unexpected or bulk deletions in the WP ULike log/history table (typically wp_ulike_logs or similar) not attributable to the owning users.
• Logs: Authentication logs showing a low-privilege account (Subscriber role) making frequent AJAX calls to the wp_ulike_delete_history_api action in a short time window.

The vulnerability was patched in the WP ULike plugin changeset 3451296, which adds ownership verification to the wp_ulike_delete_history_api AJAX action. WordPress site administrators should update the WP ULike plugin to a version beyond 4.8.3.1 that includes this fix. As a temporary workaround, administrators can remove the 'stats' capability from Subscriber and other low-privilege roles until the plugin is updated (WP Trac Changeset, Wordfence).