The Like Button Rating ? LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/d7618061-a7fa-4da4-9384-be19bc5e8548 | Exploit Third Party Advisory |
Configurations
History
07 Nov 2023, 03:31
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The Like Button Rating ? LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog. |
Information
Published : 2021-12-13 11:15
Updated : 2023-11-07 03:31
NVD link : CVE-2021-24945
Mitre link : CVE-2021-24945
JSON object : View
Products Affected
likebtn
- like_button_rating
CWE
CWE-352
Cross-Site Request Forgery (CSRF)