The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
popupbuilder:popup builder – create highly converting, mobile friendly marketing popups.
References 8
https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes…
security@wordfence.com
https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes…
security@wordfence.com
https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes…
security@wordfence.com
https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes…
security@wordfence.com
https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes…
security@wordfence.com
https://plugins.trac.wordpress.org/changeset/3755160/popup-builder/trunk/com/cl…
security@wordfence.com
https://wordpress.org/plugins/popup-builder/
security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/13af3a6e-d3ef-41f0-94…
security@wordfence.com