The WP ULike – Like & Dislike Buttons for Engagement and Feedback WordPress plugin versions up to 4.7.4 contain a CSRF vulnerability (CWE-352) due to improper nonce validation in the wp_ulike_delete_history_api() function. This flaw enables an attacker to craft a forged request that, when executed by an authenticated administrator (via user interaction such as clicking a link), can delete engagement history data. The vulnerability does not require privileges or authentication for the attacker but relies on social engineering to induce the admin action. The CVSS 3.1 base score is 4.3, reflecting low impact on confidentiality and availability but limited integrity impact.

An attacker can cause deletion of engagement data on a vulnerable WordPress site by tricking an administrator into performing a forged request. This impacts data integrity by allowing unauthorized deletion of user engagement history. There is no direct impact on confidentiality or availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the affected plugin functionality may reduce risk.