CVE-2021-24945
📋 TL;DR
The LikeBtn WordPress plugin before version 2.6.38 lacks authorization and CSRF protection in its export function, allowing any authenticated user (even subscribers) to export lists of email addresses and IPs of users who liked content. This affects WordPress sites using the vulnerable plugin version.
💻 Affected Systems
- Like Button Rating ♥ LikeBtn WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could harvest email addresses and IPs for phishing campaigns, targeted attacks, or privacy violations, potentially leading to data breaches or regulatory penalties.
Likely Case
Low-privilege users or compromised accounts export voter data, exposing personal information and violating user privacy.
If Mitigated
With proper access controls, only authorized administrators can export data, limiting exposure to trusted personnel.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward via AJAX requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.38
Vendor Advisory: https://wpscan.com/vulnerability/d7618061-a7fa-4da4-9384-be19bc5e8548
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Like Button Rating ♥ LikeBtn' and update to version 2.6.38 or later. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable Plugin
linuxTemporarily deactivate the plugin to prevent exploitation until patching.
wp plugin deactivate likebtn-like-button
Restrict AJAX Access
allUse web application firewall or .htaccess to block unauthorized access to the vulnerable AJAX endpoint.
# Add to .htaccess: RewriteRule ^wp-admin/admin-ajax\.php\?action=likebtn_export_votes - [F]
🧯 If You Can't Patch
- Restrict user registration and monitor for suspicious subscriber activity.
- Implement network segmentation to limit internal access to the WordPress admin interface.
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is below 2.6.38, it is vulnerable.Check Version:
wp plugin get likebtn-like-button --field=versionVerify Fix Applied:
Confirm plugin version is 2.6.38 or higher after update. Test export function with subscriber account; it should fail.📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to 'admin-ajax.php' with action=likebtn_export_votes from non-admin users
- Multiple failed authentication attempts followed by successful subscriber login
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php containing 'action=likebtn_export_votes' from unexpected IPs
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND "likebtn_export_votes" AND user_role="subscriber"