PT-2021-22549 · WordPress · Credova Financial

Marvin Santos · Published 2021-09-29 · Updated 2022-08-05 · CVE-2021-39342

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Credova Financial WordPress plugin versions up to, and including, 1.4.8

Description: The Credova Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled.

Recommendations: For versions up to, and including, 1.4.8, update to a version later than 1.4.8 to resolve the issue. As a temporary workaround, consider disabling the Credova Financing option on checkout pages until a patch is available. Restrict access to the AJAX action that discloses the Credova API account credentials to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-319

CWE-522

Related Identifiers

CVE-2021-39342

Affected Products

Credova Financial

References · 6

• https://plugins.trac.wordpress.org/changeset/2606811/credova-financial/trunk/credova-financial.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39342 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39342 · Vendor Advisory
• https://t.me/cibsecurity/29690 · Telegram Post
• https://wordfence.com/vulnerability-advisories/#CVE-2021-39342 · Note
• https://t.me/cvenotify/34307 · Telegram Post