cve/2021/CVE-2021-4377.md

### [CVE-2021-4377](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4377)
![](https://img.shields.io/static/v1?label=Product&message=Doneren%20met%20Mollie&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=*%3C%3D%202.8.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brighgreen)

### Description

The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.8.5 via the dmm_export_donations() function which is called via the admin_post_dmm_export hook due to missing capability checks. This can allow authenticated attackers to extract a CSV file that contains sensitive information about the donors.

### POC

#### Reference
- https://wpscan.com/vulnerability/36afc442-9634-498e-961e-4c935880cd2b

#### Github
No PoCs found on GitHub currently.