Popup Builder <= 3.72 Missing Authorization on AJAX actions
2021-01-28 00:00
PatchstackStrategic Overview
StatusPatched in 3.72
Affected Version
<= 3.71CVSS6.3Medium
CVE
N/AVulnerability Overview
The Popup Builder plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 3.71 due to missing capability checks on various actions called via AJAX. This makes it possible for attackers to import subscribers and send newsletters among other actions.
Technical Analysis
REMEDIATION: Update to version 3.72, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C