PT-2021-16380 · WordPress · Likebtn

Krzysztof Zając · Published 2021-12-13 · Updated 2022-10-25 · CVE-2021-24945

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: LikeBtn WordPress plugin versions prior to 2.6.38

Description: The issue concerns a lack of authorization and CSRF checks in the likebtn export votes AJAX action. This could allow any authenticated user, such as a subscriber, to obtain a list of email and IP addresses of individuals who liked content from the blog.

Recommendations: For versions prior to 2.6.38, update to version 2.6.38 or later to resolve the issue. As a temporary workaround, consider disabling the likebtn export votes AJAX action until a patch is available. Restrict access to the likebtn export votes endpoint to minimize the risk of exploitation. Avoid using the likebtn export votes action in the affected API endpoint until the issue is resolved.

Exploit

Fix

Information Disclosure

CSRF

Weakness Enumeration

CWE-200

CWE-352

Related Identifiers

CVE-2021-24945

Affected Products

Likebtn

References · 4

• 🔥 https://wpscan.com/vulnerability/d7618061-a7fa-4da4-9384-be19bc5e8548 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24945 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24945 · Vendor Advisory
• https://t.me/cibsecurity/33799 · Telegram Post