Vulnerability · Published Jun 21, 2021 · Assigned by WPScan

CVE-2021-24379Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass

Medium 5.3

In plain English

A medium-severity incorrect authorization in Comments Like Dislike from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)1.0%top 37.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side

Affected products (as reported)

Vendor	Product	Versions
Unknown	Comments Like Dislike	1.1.4 – before 1.1.4

Weakness: CWE-863

References

https://wpscan.com/vulnerability/aae7a889-195c-45a3-bbe4-e6d4cd2d7fd9 x_refsource_CONFIRM