Description
The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OptinMonster | OptinMonster | 2.6.4 – ≤ 2.6.4 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- OptinMonster Plugin < 2.6.5 - Unprotected REST-API http/cves/2021/CVE-2021-39341.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.