What is the CVSS score of CVE-2026-12120?

CVE-2026-12120 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

FireBox Popups CVE-2026-12120

EUVD-2026-37839 MEDIUM

Information Exposure (CWE-200)

2026-06-18 Wordfence

GHSA-6vf6-8q8x-qxcc

WordPress Information Disclosure Wordpress Plugin Firebox Popups Increase Sales And Grow Your Email List

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint with no complexity; confidentiality limited to form PII, not system credentials; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 06:18 vuln.today

CVE Published

Jun 18, 2026 - 04:31 cve.org

MEDIUM 5.3

DescriptionCVE.org

The FireBox Popups - Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via the 'form_id' parameter. This makes it possible for unauthenticated attackers to extract download a full CSV export of all form submissions - including any personally identifiable information submitted by users - for any arbitrary form_id.

AnalysisAI

Unauthenticated CSV export of form submission data in the FireBox Popups WordPress plugin (versions up to and including 3.1.7) exposes full personally identifiable information collected by any form on the site. The flaw lies in an unprotected endpoint that accepts a form_id parameter without authentication or authorization checks, allowing any remote attacker to enumerate form IDs and download complete submission records. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis, but the trivial exploitation conditions and PII exposure make this a meaningful privacy and compliance risk for affected WordPress deployments.

Technical ContextAI

The affected product is cpe:2.3:a:fireplugins:firebox_popups_-_increase_sales_and_grow_your_email_list:*:*:*:*:*:*:*:* - a WordPress plugin for popup-based lead generation and sales optimization. Source code references pinpoint the vulnerable logic in Inc/Core/Admin/Admin.php (lines 42 and 156), Inc/Core/Plugin.php (line 217), and Inc/Framework/init.php (line 254) across both the 3.1.6 and 3.1.7 tagged releases. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the CSV export functionality fails to enforce any authentication or capability check before serving form submission data, and accepts arbitrary integer form_id values with no ownership validation. Because WordPress form IDs are typically sequential integers, an attacker can trivially enumerate all existing form IDs across the site and exfiltrate submissions for each, including names, email addresses, phone numbers, or any other fields site operators configured in their forms.

RemediationAI

Upstream fix available (PR/commit) via the WordPress plugin repository changeset at revision 3572719 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3572719%40firebox&new=3572719%40firebox); a released patched version number has not been independently confirmed from available data - site administrators should update to the latest available version of FireBox Popups through the WordPress dashboard and verify the version exceeds 3.1.7. If an update is not immediately available, a compensating control is to block direct unauthenticated access to the CSV export endpoint via WAF rules or by restricting access to the relevant Admin.php endpoint (Inc/Core/Admin/Admin.php) at the web server level to authenticated admin IPs only; note this may break legitimate admin CSV export functionality. Reviewing collected form submission data for sensitivity and temporarily disabling the FireBox Popups plugin entirely is advisable for high-compliance environments (GDPR, HIPAA) until a patch is confirmed applied. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/54f939f9-2853-401a-adc0-5b727da5179b should be monitored for patched version confirmation.