Sensitive Data Exposure in Doneren met Mollie Plugin for WordPress
CVE-2021-4377

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Doneren Met Mollie
Vendor
CVE Published:
7 June 2023

Summary

The Doneren met Mollie plugin for WordPress is susceptible to sensitive data exposure through the dmm_export_donations() function, which is triggered by the admin_post_dmm_export hook. Due to a lack of proper capability checks, authenticated attackers can exploit this vulnerability to access and download a CSV file containing sensitive donor information, compromising data privacy.

Affected Version(s)

Doneren met Mollie * <= 2.8.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/information-disclosure-vulner...
https://plugins.trac.wordpress.org/changeset/2459548

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.