Description

Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-27T10:16:38.010Z",
  "pubdate": "2026-08-27T10:16:38.010Z",
  "executiveSummary": "The Like Button Rating plugin for WordPress, in versions 2.6.61 and below, contains a critical SQL Injection vulnerability. This flaw allows authenticated users with Subscriber privileges to execute arbitrary SQL queries against the underlying database.\nThe vulnerability arises due to the insufficient sanitization of user-supplied input parameters handled by the plugin's backend functionality. An attacker can manipulate database queries to bypass security controls, extract sensitive information, modify data, or potentially achieve full database compromise.\nThis vulnerability poses a significant risk to the confidentiality, integrity, and availability of the WordPress site. Because the plugin does not properly validate inputs, an attacker with low-level authenticated access can escalate their privileges or compromise the site's data without requiring administrative access. Exploitation is limited to authenticated users; however, the impact of successful exploitation is severe, potentially leading to unauthorized access to all site content, including user credentials, configuration data, and arbitrary content modification.",
  "technicalDetails": "The Like Button Rating plugin suffers from a SQL injection vulnerability rooted in the improper handling of user-controllable input passed to database query execution functions. In affected versions (<= 2.6.61), the application fails to utilize prepared statements or adequately sanitize input parameters within the specific plugin modules responsible for processing like button interactions and ratings.\nThe attack flow begins with an authenticated user (Subscriber) sending a crafted HTTP request to the vulnerable plugin endpoint. The request includes malicious payload content injected into parameters that are subsequently concatenated directly into SQL statements executed by the WordPress database abstraction layer ($wpdb). Because the application lacks robust input validation or parameterized query implementation, the database engine interprets the malicious input as part of the SQL command rather than as data.\nAn attacker can leverage this vector to execute UNION-based or time-based blind SQL injection techniques. By appending crafted SQL syntax (e.g., 'UNION SELECT'), an attacker can extract data from other tables within the database, such as the 'wp_users' table, allowing for the retrieval of hashed administrator passwords or sensitive session tokens. Furthermore, depending on database permissions and configuration, the attacker might be able to perform error-based extraction or modify data (UPDATE/INSERT) within the database tables to further manipulate the site's behavior.\nThis vulnerability is classified as an authenticated SQL injection, as it requires a valid, logged-in Subscriber-level account to access the vulnerable functionality. The flaw is not exposed to unauthenticated users, but the privilege level required is minimal, making it an attractive target for account-based attacks. The impact of this vulnerability is total database exposure, facilitating data exfiltration, modification of application logic, or potentially further lateral movement depending on the server environment's configuration."
}