CVE-2021-39342 Credova_Financial <= 1.4.8 Sensitive Information Disclosure
The Credova Financial WordPress plugin leaks API credentials in plaintext during checkout, allowing attackers to steal sensitive account information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39342?
CVE-2021-39342 is a medium-severity vulnerability in Credova_Financial, published on 29 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8.
Which versions are affected by CVE-2021-39342?
It affects 1 product.
Products include Credova Financial.
How do I fix CVE-2021-39342?
No fix has been published for CVE-2021-39342 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-39342 being exploited?
There is no known exploitation of CVE-2021-39342 in the wild and no public exploit code.
Sources
Also known as GHSA-x9xx-826m-934x.