CVE-2022-45842 MEDIUM

CVE-2022-45842: WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerability

Vendor Technowich
Product WP ULike (WordPress plugin)
Weakness CWE-367
Published November 30, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores.

Explanation of Vulnerability in Simple Terms

02Summary

WP ULike versions 4.6.4 and earlier contain a time-of-check-time-of-use (TOCTOU) vulnerability that allows an attacker to modify data integrity without authentication. The vulnerability stems from a race condition in how the plugin handles concurrent requests. An attacker can exploit this over the network without requiring user interaction or special privileges.

What an attacker can do

03Attacker Capabilities

Modify plugin data or settings by exploiting a race condition between validation and execution.

Potential impact on your site

04Site Impact

Site data or plugin functionality could be altered by an unauthenticated attacker, potentially affecting site behavior or user experience.

Conditions required to exploit

05Prerequisites

Network access to the WordPress site; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 30, 2022 CVE published
April 28, 2026 Record updated