CVE-2026-78285: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in LikeBtn Like Button Rating

This vulnerability, identified as CWE-89, involves improper neutralization of special elements in SQL commands within the Like Button Rating plugin. Specifically, subscriber-level SQL Injection is possible in versions up to 2.6.61, enabling attackers to manipulate SQL queries. The CVSS 3.1 score of 8.5 reflects network attack vector, low attack complexity, required privileges at the subscriber level, no user interaction, and a scope change with high confidentiality impact and low availability impact. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and minor disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability requires attacker privileges at the subscriber level and can be exploited remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit subscriber privileges where possible and monitor for unusual database activity related to the Like Button Rating plugin.