What’s Vulnerable › Vulnerabilities

CVE-2021-24945: Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-13 · updated 2026-06-17
• Weakness: CWE-200

Description

The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.

Affected products

• Like Button Rating ♥ LikeBtn: before 2.6.38 — fixed in 2.6.38

How to fix

Upgrade to a fixed version: Like Button Rating ♥ LikeBtn 2.6.38. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/d7618061-a7fa-4da4-9384-be19bc5e8548
• https://wpscan.com/vulnerability/d7618061-a7fa-4da4-9384-be19bc5e8548

Get alerted when CVE-2021-24945 or the next vulnerability affects your stack