Log out
Get PRO

Latest

Access violation vulnerability in Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation 2.6.4

  • Severity: high-risk
  • Status: Fixed
  • Publication: November 1, 2021

The OptinMonster WordPress plugin has a security issue that affects versions up to and including 2.6.4. This issue can allow malicious web scripts to be injected on sites with the plugin installed and it can also lead to the disclosure of sensitive information and unauthorized changes to settings. The cause of the issue is an insufficient authorization validation process via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file.

Detected in:

Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation fixed vulnerable versions:
Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation fixed vulnerable versions: >= * <= 2.6.4
WordPress Popup Builder & Popup Maker – OptinMonster Email Marketing and Lead Generation fixed vulnerable versions:

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.