CVE-2025-62902
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/a through <= 1.3.8.
AnalysisAI
Sensitive system information disclosure in ThemeHunk WP Popup Builder plugin for WordPress (versions ≤1.3.8) allows unauthenticated remote attackers to retrieve embedded sensitive data without authentication. The vulnerability presents a CVSS 7.5 HIGH severity with confirmed network-based exploitation requiring no user interaction. EPSS score of 0.03% (10th percentile) indicates minimal observed exploitation activity, and no public exploit identified at time of analysis. The flaw stems from improper exposure of sensitive information to unauthorized control spheres (CWE-497).
Technical ContextAI
This vulnerability affects the WP Popup Builder WordPress plugin (cpe:2.3:a:themehunk:wp_popup_builder) through version 1.3.8. The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), indicating the plugin improperly exposes system-level or configuration data through accessible endpoints or responses. In WordPress plugin architectures, this typically manifests through unsecured AJAX handlers, REST API endpoints without capability checks, or direct file access to configuration data. The vulnerability allows retrieval of embedded sensitive data, which could include database credentials, API keys, installation paths, user enumeration data, or plugin configuration details. The CVSS vector indicates network-based exploitation (AV:N) with low complexity (AC:L) and no required privileges (PR:N) or user interaction (UI:N), suggesting the sensitive data is exposed through publicly accessible plugin endpoints or files.
RemediationAI
WordPress administrators should immediately upgrade WP Popup Builder to the latest version available from the WordPress plugin repository or ThemeHunk's official distribution channels, ensuring the version exceeds 1.3.8 where the vulnerability exists. Verify successful update by checking plugin version in WordPress admin dashboard under Plugins menu. If an updated version addressing this CVE is not yet available, implement temporary compensating controls including restricting access to WordPress admin areas via IP allowlisting at web server or WAF level, implementing file integrity monitoring to detect unauthorized access to plugin directories, and reviewing web server access logs for suspicious requests to wp-popup-builder endpoints. Organizations should audit what sensitive information may have been exposed by reviewing plugin configuration files and database entries. Complete vulnerability details and mitigation guidance are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-popup-builder/vulnerability/wordpress-wp-popup-builder-plugin-1-3-6-sensitive-data-exposure-vulnerability. Consider evaluating alternative popup builder plugins with stronger security track records if vendor response is inadequate.
Share
External POC / Exploit Code
Leaving vuln.today