# CVE-2026-78285: Like Button Rating SQL injection

Source: https://junglewise.ai/threats/cve-2026-78285-like-button-rating-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78285 · Severity: high · CVSS 8.5 · Published 2026-08-27

The Like Button Rating WordPress plugin contains a SQL injection vulnerability that allows authenticated subscribers to read, modify, or delete the entire database, including user accounts and sensitive customer data. Exploitation requires subscriber-level access but could lead to complete compromise of a WordPress site's data and user privacy.

Vendors: [Themeisle](https://junglewise.ai/threats/vendors/themeisle).

## Quick answers

**Is CVE-2026-78285 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78285 being exploited in the wild.

**How severe is CVE-2026-78285?** High severity, with a CVSS score of 8.5, published 27 August 2026.

**Which products and versions are affected?** Themeisle Like Button Rating <= 2.6.61.

**Is there a fix for CVE-2026-78285?** A patch was published on 2026-08-25: Patch released in version 2.6.62 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78285 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78285?** Check whether you run Themeisle Like Button Rating at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the Like Button Rating WordPress plugin versions 2.6.61 and earlier. The vulnerability requires subscriber-level privileges to exploit but allows an attacker to execute arbitrary SQL queries against the WordPress database. An attacker with subscriber access can read, modify, or delete sensitive data including user accounts, posts, and private information. The vulnerability has been patched in version 2.6.62, and users should update immediately to mitigate the risk.

## Affected products

- ThemeIsle Like Button Rating <= 2.6.61

## Timeline

- 2026-08-25: disclosed: Vulnerability reported to Patchstack
- 2026-08-27: advisory: CVE-2026-78285 published
- 2026-08-25: patched: Patch released in version 2.6.62

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/likebtn-like-button/vulnerability/wordpress-like-button-rating-plugin-2-6-61-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/likebtn-like-button/vulnerability/wordpress-like-button-rating-plugin-2-6-61-sql-injection-vulnerability?_s_id=cve)