PT-2021-22548 · WordPress · Optinmonster

Chloe Chamberland

·

Published

2021-10-29

·

Updated

2025-06-12

·

CVE-2021-39341

CVSS v3.1

8.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions: OptinMonster WordPress plugin versions up to, and including, 2.6.4
Description: The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation. This issue can be exploited to inject malicious web scripts on sites with the plugin installed. The vulnerability affects over 1 million sites and allows for unauthorized access to the API, disclosure of confidential information, and malicious JavaScript code injection. The logged in or has api key function in the ~/OMAPI/RestApi.php file is specifically implicated. An attacker with an API key can make changes to OptinMonster accounts or place malicious JavaScript code on a site, which will be executed every time an OptinMonster element is activated. The API endpoint /wp-json/omapp/v1/support can reveal sensitive data such as the full path to the site on the server and API keys used for site requests.
Recommendations: For versions up to, and including, 2.6.4, update to version 2.6.5 or later to resolve the issue. Additionally, consider restricting access to the API and limiting the use of WordPress site keys to modify OptinMonster campaigns until the update is applied. As a temporary workaround, consider disabling the logged in or has api key function in the ~/OMAPI/RestApi.php file until a patch is available.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-863CWE-285CWE-319

Related Identifiers

CVE-2021-39341

Affected Products

Optinmonster