FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter
Strategic Overview
- Status
- Patched in 3.1.8
- Affected Plugin
- FireBox Popups – Increase Sales and Grow Your Email List
- Affected Version
<= 3.1.7- CVSS
- 5.3Medium
- Weakness type
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CVE
CVE-2026-12120
At a glance
CVE-2026-12120 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the FireBox Popups WordPress plugin, affecting versions <= 3.1.7. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 3.1.8; sites on affected versions should update now. Disclosed June 2026, reported by Duc Manh.
Vulnerability Overview
The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via the 'form_id' parameter. This makes it possible for unauthenticated attackers to extract download a full CSV export of all form submissions — including any personally identifiable information submitted by users — for any arbitrary form_id.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
FireBox Popups <= 3.1.7 carries this weakness at form_id, and reaching it takes no account at all. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.
The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For FireBox Popups the fix is 3.1.8: builds <= 3.1.7 are affected, anything from 3.1.8 onward is not.
Remediation
Update to version 3.1.8, or a newer patched version
How does WordSec protect against this?
This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: FireBox Popups 3.1.8 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Related records
Other vulnerabilities in FireBox Popups – Increase Sales and Grow Your Email List
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C