CVE-2021-39341

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.

CVSS v3.1

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CVSS v2.0

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

21.93% chance of exploitation in the next 30 days, 97th percentile

Nuclei

high

Published

2021-11-01

Updated

2025-03-31

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39341.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-39327
• CVE-2021-39350
• CVE-2021-39322
• CVE-2021-39352
• CVE-2021-39320
• CVE-2021-39373