CVE-2016-10996 Missing authorization in n/a
The OptinMonster WordPress plugin allows unauthorized access to shortcodes due to a nonce leak, enabling security bypass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-10996?
CVE-2016-10996 is a medium-severity missing authorization vulnerability in n/a, published on 20 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
Weakness: CWE-863
Which versions are affected by CVE-2016-10996?
It affects 1 product.
Products include Optinmonster Optinmonster.
How do I fix CVE-2016-10996?
No fix has been published for CVE-2016-10996 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-10996 being exploited?
There is no known exploitation of CVE-2016-10996 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-39341 OptinMonster <= 2.6.4 Unprotected REST-API Endpoints
- CVE-2023-0772 Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure
- CVE-2024-4045 Cross-site scripting in Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
- CVE-2021-39325 OptinMonster <= 2.6.0 Reflected Cross-Site Scripting
Sources
Also known as GHSA-83fm-966g-68w9.