CVE-2021-39342: 
WordPress vulnerability analysis and mitigation

The Credova_Financial WordPress plugin, versions up to and including 1.4.8, contains a sensitive information disclosure vulnerability identified as CVE-2021-39342. The vulnerability exposes the site's Credova API account credentials (username and password) in plaintext through an AJAX action when users access the checkout page with the Credova Financing option enabled (CVE Details).

The vulnerability exists in the plugin's AJAX functionality where API credentials are exposed during the checkout process. The issue was fixed in version 1.4.9 by modifying how credential information is handled during AJAX calls, as evidenced by the code changes that removed direct passing of API credentials through JavaScript (WordPress Plugin Repo).

This vulnerability could allow attackers to obtain the site's Credova API credentials, potentially enabling unauthorized access to the site's Credova financial services account and associated financial operations (Wordfence Advisory).

Site administrators should update the Credova_Financial plugin to version 1.4.9 or later, which addresses this vulnerability by removing the exposure of API credentials in AJAX calls (WordPress Plugin Repo).