CVE-2021-4377: Doneren met Mollie <= 2.8.4 - Information Disclosure
The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.8.5 via the dmmexportdonations() function which is called via the adminpostdmmexport hook due to missing capability checks. This can allow authenticated attackers to extract a CSV file that contains sensitive information about the donors.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4377?
CVE-2021-4377 is classified as a medium severity vulnerability due to sensitive data exposure risks.
How do I fix CVE-2021-4377?
To fix CVE-2021-4377, update the Doneren met Mollie plugin to version 2.8.6 or later.
Who is affected by CVE-2021-4377?
CVE-2021-4377 affects users of the Doneren met Mollie plugin for WordPress versions up to and including 2.8.5.
What data is exposed by CVE-2021-4377?
CVE-2021-4377 can allow authenticated attackers to extract sensitive donation information from the website.
What function is responsible for the vulnerability in CVE-2021-4377?
The dmm_export_donations() function is responsible for the vulnerability in CVE-2021-4377 due to missing capability checks.