A vulnerability (CVE-2021-39341) has been identified in the WordPress plugin OptinMonster, which has over a million active installations and is used for creating pop-up notifications and offers. This vulnerability allows an attacker to place their own JavaScript code on a site using the plugin. The issue has been resolved in version 2.6.5. To block access via compromised keys after the update, the developers of OptinMonster have revoked all previously created API access keys and added restrictions on the usage of keys from WordPress sites to modify OptinMonster campaigns.
The problem was caused by the presence of the REST API /wp-json/omapp/v1/support, which was accessible without authentication — the request could be executed without any additional checks as long as the Referer header contained the string "https://wp.app.optinmonster.test" and the HTTP request type was set to "OPTIONS" (overridden via the HTTP header "X-HTTP-Method-Override"). Among the data returned when accessing the mentioned REST API was an access key that allowed sending requests to any REST API handlers.
Using the obtained key, an attacker could modify any pop-up blocks displayed by OptinMonster, including executing their own JavaScript code. By being able to execute their JavaScript code within the context of the site, the attacker could redirect users to their own site or perform a substitution of a privileged account in the web interface when the injected JavaScript code was executed by the site administrator. With access to the web interface, the attacker could achieve the execution of their PHP code. server.
Source: opennet.ru
