CVE-2021-39341

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.

• CWE-285
• CWE-319
• CWE-863

• https://plugins.trac.wordpress.org/browser/optinmonster/trunk/OMAPI/RestApi.php?rev=2606519#L1460Third Party Advisory
• https://wordfence.com/vulnerability-advisories/#CVE-2021-39341Third Party Advisory
• https://www.wordfence.com/blog/2021/10/1000000-sites-affected-by-optinmonster-vulnerabilities/Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/optinmonster/trunk/OMAPI/RestApi.php?rev=2606519#L1460Third Party Advisory
• https://wordfence.com/vulnerability-advisories/#CVE-2021-39341Third Party Advisory
• https://www.wordfence.com/blog/2021/10/1000000-sites-affected-by-optinmonster-vulnerabilities/Exploit, Third Party Advisory

Published

Nov 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39336The Job Manager WordPress plugin is vulnerable to Stored Cro…4.8
• CVE-2021-39337The job-portal WordPress plugin is vulnerable to Stored Cros…4.8
• CVE-2021-39338The MyBB Cross-Poster WordPress plugin is vulnerable to Stor…4.8
• CVE-2021-39339The Telefication WordPress plugin is vulnerable to Open Prox…5.3
• CVE-2021-3934ohmyzsh is vulnerable to Improper Neutralization of Special …7.5
• CVE-2021-39340The Notification WordPress plugin is vulnerable to Stored Cr…4.8
• CVE-2021-39342The Credova_Financial WordPress plugin discloses a site's as…7.5
• CVE-2021-39343The MPL-Publisher WordPress plugin is vulnerable to Stored C…4.8
• CVE-2021-39344The KJM Admin Notices WordPress plugin is vulnerable to Stor…4.8
• CVE-2021-39345The HAL WordPress plugin is vulnerable to Stored Cross-Site …4.8
• CVE-2021-39346The Google Maps Easy WordPress plugin is vulnerable to Store…4.8
• CVE-2021-39347The Stripe for WooCommerce WordPress plugin is missing a cap…4.3