Vulnerability · Published Apr 5, 2021 · Assigned by WPScan
CVE-2021-24150Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF
High 7.5
In plain English
A high-severity server-side request forgery in Like Button Rating ♥ LikeBtn from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.3%top 8.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Like Button Rating ♥ LikeBtn | 2.6.32 – before 2.6.32 |
Weakness: CWE-918
References
- https://wpscan.com/vulnerability/6bc6023f-a5e7-4665-896c-95afa5b638fb x_refsource_CONFIRM