CVE-2019-13344

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Jul 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-133456.1The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.CVE-2019-133466.1In MyT 1.5.1, the User[username] parameter has XSS.CVE-2019-133477.5An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Ji CVE-2019-133488.8In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in clearte CVE-2019-133494.9In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.CVE-2019-13357.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C CVE-2019-133518.1posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descript CVE-2019-133529.8WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. CVE-2019-133549.8The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The cu CVE-2019-133557.8In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedu CVE-2019-133567.8In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ use CVE-2019-133577.8In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe allows local attackers t