CVE-2019-13344
MEDIUMCRUDLab WP Like Button <= 1.6.0 - Unauthenticated Settings Update via contains() Function
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-13344. PoCs published by Benjamin Lim.
AI-analyzed exploit summary This exploit demonstrates an authentication bypass vulnerability in WP Like Button 1.6.0, allowing unauthenticated attackers to modify plugin settings via a crafted POST request. The PoC uses curl to change the `each_page_url` parameter, enabling Facebook like hijacking.
Description
An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter.
Exploits (1)
This exploit demonstrates an authentication bypass vulnerability in WP Like Button 1.6.0, allowing unauthenticated attackers to modify plugin settings via a crafted POST request. The PoC uses curl to change the `each_page_url` parameter, enabling Facebook like hijacking.
References (4)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N