Description
WordPress Plugin WordPress Popups for Marketing and Email Newsletters, Lead Generation and Conversions by OptinMonster is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently access sensitive information and make changes to any campaign associated with a site�s connected OptinMonster account, or add malicious JavaScript. WordPress Plugin WordPress Popups for Marketing and Email Newsletters, Lead Generation and Conversions by OptinMonster version 2.6.4 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.6.5 or latest
References
https://www.wordfence.com/blog/2021/10/1000000-sites-affected-by-optinmonster-vulnerabilities/
https://plugins.svn.wordpress.org/optinmonster/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin Knews Multilingual Newsletters Cross-Site Request Forgery (1.2.5)
PHP Integer Overflow or Wraparound Vulnerability (CVE-2017-5340)
Microsoft SQL Server Other Vulnerability (CVE-2000-1081)
WordPress Plugin ImageBoss-Images Up To 60% Smaller & CDN Cross-Site Scripting (3.0.4)
Plone CMS Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-33926)