CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.
AnalysisAI
Aethonic Poptics WordPress plugin through version 1.0.20 exposes sensitive system information to authenticated users through an information disclosure vulnerability. Authenticated attackers with low-level privileges can retrieve embedded sensitive data without user interaction, though exploitation requires valid login credentials. The issue carries a modest CVSS score of 4.3 and extremely low EPSS probability (0.04th percentile), indicating real-world exploitation risk is minimal despite the confirmed vulnerability.
Technical ContextAI
This vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), which describes a failure to properly restrict access to sensitive data within system boundaries. The Aethonic Poptics plugin (a WordPress plugin for AI-powered popup building and lead generation) contains inadequate access controls that allow authenticated users with low privileges to retrieve sensitive embedded data that should be restricted. The root cause is insufficient data isolation or authorization checks between privilege levels, allowing lateral data exposure within the same authenticated context. The vulnerability affects all versions from the beginning of tracked version history through version 1.0.20.
Affected ProductsAI
Aethonic Poptics WordPress plugin versions up to and including 1.0.20 are affected. The vulnerability impacts all installations of this AI-powered popup builder plugin for WordPress that have not been patched beyond version 1.0.20. Additional product information and the full advisory are available through the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/poptics/vulnerability/wordpress-poptics-ai-powered-popup-builder-for-lead-generation-conversions-exit-intent-email-opt-ins-woocommerce-sales-plugin-1-0-20-sensitive-data-exposure-vulnerability?_s_id=cve
RemediationAI
Update the Aethonic Poptics WordPress plugin to the patched version immediately available from the plugin repository or vendor update mechanism. The recommended action is to upgrade to a version newer than 1.0.20, which should be available through the WordPress Plugin Directory or directly from Aethonic. Administrators should verify the patched version restricts access to embedded sensitive data based on user privilege level. For installations unable to immediately patch, restrict WordPress user accounts to only essential roles and reduce the number of low-privileged accounts with plugin access. Refer to the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/poptics/vulnerability/...) for the exact patched version number once released.
Share
External POC / Exploit Code
Leaving vuln.today