CVE-2019-13344

An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter.

CVSS v3.0

5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

45.09% chance of exploitation in the next 30 days, 99th percentile

Published

2019-07-05

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/153541/WordPress-Like-Button-1.6.0-Authentication-By…
• https://limbenjamin.com/articles/wp-like-button-auth-bypass.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/47078

References

• CVE Record
• NVD entry

Related

• CVE-2019-13343
• CVE-2019-13346
• CVE-2019-13341
• CVE-2019-13352
• CVE-2019-13340
• CVE-2019-13358