← Vulnerability feed

Vulnerability record · CVE-2021-39341 · published 1 November 2021

CVE-2021-39341: Optinmonster improper authorization vulnerability

Optinmonster · Optinmonster

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.

8.2 CVSS 3.1 High EPSS 22% · top 2.4% CWE-285 · Improper authorizationCWE-319 · Cleartext transmission
8.2CVSS 3.1 base score, v2 6.4
22%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://plugins.trac.wordpress.org/browser/optinmonster/trunk/OMAPI/RestApi.php?rev=2606519#L1460 Third Party Advisory
https://wordfence.com/vulnerability-advisories/#CVE-2021-39341 Third Party Advisory
https://www.wordfence.com/blog/2021/10/1000000-sites-affected-by-optinmonster-vulnerabilities/ ExploitThird Party Advisory
https://plugins.trac.wordpress.org/browser/optinmonster/trunk/OMAPI/RestApi.php?rev=2606519#L1460 Third Party Advisory
https://wordfence.com/vulnerability-advisories/#CVE-2021-39341 Third Party Advisory
https://www.wordfence.com/blog/2021/10/1000000-sites-affected-by-optinmonster-vulnerabilities/ ExploitThird Party Advisory

Track CVE-2021-39341 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2023-0772Optinmonster vulnerabilityThe Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a cam…EPSS 0.78%6.1CVE-2021-39325Optinmonster cross-site scripting vulnerabilityThe OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function …EPSS 0.91%5.4CVE-2024-4045Optinmonster cross-site scripting vulnerabilityThe Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for WordPress is vulnerable to Stored C…EPSS 0.32%5.3CVE-2016-10996Optinmonster incorrect authorization vulnerabilityThe optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.EPSS 1.1%8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed9.8CVE-2021-28799QNAP HBS 3 improper authorization allows remote loginQNAP Hybrid Backup Sync 3 (HBS 3) contains an improper authorization flaw that lets remote attackers log in to the NAS device. The issue affects mult…KEVEPSS 78%analysed

Source: NIST National Vulnerability Database (record CVE-2021-39341), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.