Vulnerability · Published Jun 15, 2024 · Assigned by Wordfence
CVE-2024-2544Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions
High 7.4
In plain English
A high-severity missing authorization in Popup Builder – Create highly converting, mobile friendly marketing popups. from popupbuilder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Official description
The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions, such as deleting subscribers, and importing subscribers to conduct stored cross-site scripting attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| popupbuilder | Popup Builder – Create highly converting, mobile friendly marketing popups. | 0 – through 4.3.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L