What’s Vulnerable › Vulnerabilities

CVE-2021-39341: OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

• Severity: medium (CVSS 6.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 21.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-01 · updated 2026-06-17
• Weakness: CWE-285

Description

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.

Affected products

• OptinMonster: through 2.6.4

References

• https://plugins.trac.wordpress.org/browser/optinmonster/trunk/OMAPI/RestApi.php?rev=2606519#L1460
• https://wordfence.com/vulnerability-advisories/#CVE-2021-39341
• https://www.wordfence.com/blog/2021/10/1000000-sites-affected-by-optinmonster-vulnerabilities/
• https://plugins.trac.wordpress.org/browser/optinmonster/trunk/OMAPI/RestApi.php?rev=2606519#L1460
• https://wordfence.com/vulnerability-advisories/#CVE-2021-39341
• https://www.wordfence.com/blog/2021/10/1000000-sites-affected-by-optinmonster-vulnerabilities/

Get alerted when CVE-2021-39341 or the next vulnerability affects your stack