CVE-2021-39341CWE-285CWE-319

OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

High · published November 1, 2021

CVSS v3.1

8.2

EPSS

22%

Percentile

97.7

In the wild

Unconfirmed

What it is

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.

The record

Technical detail

CVSS v3.1: 8.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.21929 · 97.7th percentile
Weaknesses: CWE-285 · Improper Authorization; CWE-319 · Cleartext Transmission of Sensitive Information
Published: 2021-11-01T21:01Z

EPSS history

Timeline

01 NOV 21:01Z
OptinMonster <= 2.6.4 Unprotected REST-API Endpoints
cvelistv5