The Like Button Rating plugin for WordPress is vulnerable to an SQL injection flaw that allows authenticated attackers to potentially compromise sensitive database information.

The plugin suffers from improper neutralization of special elements used in an SQL command, classified as CWE-89. This vulnerability allows an attacker with Subscriber-level privileges to inject malicious SQL queries via the application.

Successful exploitation of this vulnerability can result in unauthorized access to sensitive database content, potentially leading to data breaches or the exposure of private user information. With a CVSS score of 8.5, this high-severity flaw represents a significant risk to the integrity and confidentiality of the WordPress environment.

Immediate Action: Update the WordPress Like Button Rating plugin to version 2.6.62 or later immediately to resolve the identified security gap.

Proactive Monitoring: Review database access logs for unusual query patterns or unexpected syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: No (exploit_available: false).

This vulnerability presents a clear risk to data security for any site utilizing the affected plugin. Administrators should prioritize updating to version 2.6.62 to eliminate the SQL injection vector. Failure to apply this update leaves the underlying database exposed to unauthorized query execution by any authenticated subscriber.