Like Button Rating CVE-2026-78285

Exploitation requires the attacker to hold a valid Subscriber-level (or higher) WordPress account on the target site - the lowest authenticated role. The Like Button Rating plugin (version <= 2.6.61) must be installed and active. No special plugin configuration is needed beyond the plugin being present and enabled. Exploitation is limited by the requirement for any valid authenticated session: sites that disable open user registration and have no untrusted registered users are significantly less exposed. There is no reported requirement for a specific plugin feature to be enabled, and no user interaction from an administrator or higher-privileged user is needed.

The CVSS 8.5 score reflects a genuinely high-priority issue for any WordPress site running this plugin with open user registration. The PR:L metric confirms exploitation requires only a Subscriber account - the lowest authenticated role in WordPress - making this accessible to any registered user on a site that allows self-registration, a common configuration. AV:N/AC:L/UI:N means exploitation is straightforward and fully remote with no interaction from a privileged user. The S:C/C:H combination is the primary risk driver: an attacker with a Subscriber account could exfiltrate WordPress user table data including password hashes, enabling offline cracking and account takeover. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. No KEV listing and no POC availability further suggest this has not yet been widely weaponized, though the low barrier to exploitation (Subscriber access, low complexity) makes it an attractive target once details become public via the Patchstack advisory.

An attacker registers a free Subscriber account on a WordPress site with open registration enabled and the Like Button Rating plugin installed. Using a crafted HTTP request to the vulnerable plugin endpoint, the attacker injects a UNION-based or time-based blind SQL payload into an unsanitized parameter, extracting the wp_users table to retrieve usernames and password hashes. The hashes are taken offline for cracking, potentially yielding administrator credentials and full site compromise.