Credova Financial, CVE-2021-39342

CVE, Research URL: CVE-2021-39342
Home page URL: Security reports for Credova Financial
Application: Credova Financial
Published on: Sep 30, 2021
Research Description: The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8.
Affected versions: Min -, max 1.4.9.
Status: vulnerable