WordPress Plugin Vulnerabilities
OptinMonster <= 1.1.4.5 - Execution of Arbitrary Shortcodes
Description
Unauthenticated users are able to execute arbitrary WordPress shortcodes via a simple HTTP GET request. While the command is protected by a nonce, the nonce is leaked on every page load.
Affects Plugins
Fixed in 1.1.4.6 References
Classification
Type
AUTHBYPASS
OWASP top 10
CWE
CVSS
Miscellaneous
Submitter
James Golovich
Submitter website
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2016-03-22 (about 10 years ago)
Added
2016-03-22 (about 10 years ago)
Last Updated
2020-09-22 (about 5 years ago)
WPScan 