CVE-2021-39342

HOCH 7.5CVE-2021-39342 · Published 29/09/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-39342 ist eine Schwachstelle (HOCH (CVSS 7.5)) in financial (credova).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.77%, höher als bei 55.7% aller Schwachstellen.
Abhilfe: auf 1.4.9 oder neuer aktualisieren.

Package	Affected versions	Patched versions
financial credova	`< 1.4.9`	`1.4.9`

Description

The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8.

References

plugins.trac.wordpress.org/changeset/2606811/credova-financial/trunk/credova-financial.php · Patch
wordfence.com/vulnerability-advisories · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free