PT-2023-12488 · WordPress · Doneren Met Mollie

Jerome Bruandet · Published 2023-06-07 · Updated 2023-06-13 · CVE-2021-4377

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Doneren met Mollie plugin for WordPress versions up to and including 2.8.5

Description The issue concerns Sensitive Data Exposure due to missing capability checks in the dmm export donations() function, which is called via the admin post dmm export hook. This allows authenticated attackers to extract a CSV file containing sensitive donor information.

Recommendations For versions up to and including 2.8.5, update to a version that includes the necessary capability checks to prevent Sensitive Data Exposure. As a temporary workaround, consider restricting access to the admin post dmm export hook to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-4377

Affected Products

Doneren Met Mollie

References · 6

• 🔥 https://wpscan.com/vulnerability/36afc442-9634-498e-961e-4c935880cd2b · Exploit
• 🔥 https://blog.nintechnet.com/information-disclosure-vulnerability-fixed-in-wordpress-doneren-met-mollie-plugin · Exploit
• https://plugins.trac.wordpress.org/changeset/2459548 · Patch
• https://osv.dev/vulnerability/CVE-2021-4377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4377 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ed99a056-42c6-4540-950e-12f8b547b64d?source=cve · Note