Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File
Vulnerability Description
The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the Subscribers Import feature. This makes it possible for unauthenticated attackers to extract sensitive data after an administrator has imported subscribers via a CSV file. This data may include the first name, last name, e-mail address, and potentially other personally identifiable information of subscribers.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-2541
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Tim Coen
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/086cd6a0-adb6-4e12-b34c-630297f036f3?source=cve
- https://plugins.trac.wordpress.org/browser/popup-builder/trunk/com/libs/Importer.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3258023%40popup-builder%2Ftrunk&old=3227597%40popup-builder%2Ftrunk&sfp_email=&sfph_mail=
More from popupbuilder
View All →Affected Vendor
popupbuilder
View all reports →