A critical vulnerability has been identified within WordPress’s popular OptinMonster plugin that could allow an unauthenticated attacker to access REST-API endpoints to export sensitive information and add malicious JavaScript to WordPress sites. OptinMonster, which has been installed on approximately 1,000,000 WordPress sites, is a lead generation and monetization plugin that allows administrators to build opt-in subscription forms for the customers using their sites. The API endpoint in question, “/wp-json/omapp/v1/support”, can be exploited to show the site’s full server path, and disclose API keys used during requests. An unauthenticated threat actor who was able to retrieve an API key could easily make changes on the site and embed malicious code that executes every time a user visits the site. To mitigate this critical vulnerability, users are urged to download every WordPress update released in the next few weeks. The Ankura CTAPT will continue to report on WordPress vulnerabilities, and relevant updates to the status of the OptinMonster plugin will be released as that information becomes public.