CVE-2021-24945 Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure
Authenticated users can export email and IP addresses of voters due to missing authorization checks in the Like Button Rating plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24945?
CVE-2021-24945 is a high-severity missing authorization vulnerability in Unknown Like Button Rating ♥ LikeBtn, published on 13 Dec 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.
Which versions are affected by CVE-2021-24945?
It affects 1 product.
Products include Likebtn Like Button Rating.
How do I fix CVE-2021-24945?
No fix has been published for CVE-2021-24945 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24945 being exploited?
There is no known exploitation of CVE-2021-24945 in the wild and no public exploit code.
Other vulnerabilities in Unknown Like Button Rating ♥ LikeBtn
Sources
Also known as GHSA-v7hx-7773-729x.