EUVD-2026-37839
GHSA-6vf6-8q8x-qxcc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated endpoint with no complexity; confidentiality limited to form PII, not system credentials; no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The FireBox Popups - Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via the 'form_id' parameter. This makes it possible for unauthenticated attackers to extract download a full CSV export of all form submissions - including any personally identifiable information submitted by users - for any arbitrary form_id.
AnalysisAI
Unauthenticated CSV export of form submission data in the FireBox Popups WordPress plugin (versions up to and including 3.1.7) exposes full personally identifiable information collected by any form on the site. The flaw lies in an unprotected endpoint that accepts a form_id parameter without authentication or authorization checks, allowing any remote attacker to enumerate form IDs and download complete submission records. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the target WordPress site having the FireBox Popups plugin installed and active in a version up to and including 3.1.7. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 (Medium) - driven by AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - accurately reflects exploitability: this is remotely reachable, requires no authentication, and carries zero complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a series of unauthenticated HTTP GET requests to the WordPress site's FireBox export endpoint, incrementing the `form_id` parameter from 1 upward. For each valid form ID, the endpoint returns a downloadable CSV file containing all historical user submissions for that form - potentially including full names, email addresses, phone numbers, and any other PII collected through popups. … |
| Remediation | Upstream fix available (PR/commit) via the WordPress plugin repository changeset at revision 3572719 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3572719%40firebox&new=3572719%40firebox); a released patched version number has not been independently confirmed from available data - site administrators should update to the latest available version of FireBox Popups through the WordPress dashboard and verify the version exceeds 3.1.7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today