Vulnerability · Published Jun 15, 2024 · Assigned by Wordfence
CVE-2023-6696Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure
High 8.1
In plain English
A high-severity missing authorization in Popup Builder – Create highly converting, mobile friendly marketing popups. from popupbuilder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a nonce check, the nonce can be obtained from the profile page of a logged-in user. This allows subscribers to perform several actions including deleting subscribers and perform blind Server-Side Request Forgery.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| popupbuilder | Popup Builder – Create highly converting, mobile friendly marketing popups. | 0 – through 4.3.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N