Improper Authorization in Popups by OptinMonster - Best WordPress Lead Generation Plugin - CVE-2021-39341
Published: November 4, 2021
Vulnerability identifier: #VU57927
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-39341
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization check.
The vulnerability exists due to insufficient authorization validation within the "logged_in_or_has_api_key" function in the ~/OMAPI/RestApi.php file. A remote attacker can gain access to sensitive information and update settings.
Affected software
Popups by OptinMonster - Best WordPress Lead Generation Plugin
How to mitigate CVE-2021-39341
Install updates from vendor's website.
Popups by OptinMonster - Best WordPress Lead Generation Plugin - update to 2.6.5