CVE-2020-9006 - CVE House
Back to Database
Status published Critical CVE-2020-9006

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is...

Vulnerability Description

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-9006

Credits & Attribution

No credits recorded in the NVD database.

References

More from sygnoos

View All →
CVE-2024-1685
Social Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection
High 8.8
CVE-2020-10196
An XSS vulnerability in the popup-builder plugin before 3.64.1 for...
Medium 6.1
CVE-2020-10195
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure...
Medium 6.3
CVE-2019-14695
A SQL injection vulnerability exists in the Sygnoos Popup Builder...
Critical 9.8

Affected Vendor

Affected Software

popup builder
Vulnerable Versions:
2.2.8

Timeline

Official Publish: February 17th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.