Popup Builder Create Highly Converting Mobile Friendly Marketing Popups
Monthly
Unauthenticated attackers can trash every published popup on WordPress sites running the Popup Builder plugin through version 4.4.5 by sending a single GET request with the sg_popup_preview_id parameter. The plugin fails to verify authorization for the trash action (CWE-862), and a second flaw in SGPopup::find() causes the request to match all published popups so the deletion runs against each of them, affecting integrity and availability of popup content with no confidentiality impact. CVSS 3.1 is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); no public exploit identified at time of analysis, and the vuln.today decision label is act_now.
Unauthenticated attackers can trash every published popup on WordPress sites running the Popup Builder plugin through version 4.4.5 by sending a single GET request with the sg_popup_preview_id parameter. The plugin fails to verify authorization for the trash action (CWE-862), and a second flaw in SGPopup::find() causes the request to match all published popups so the deletion runs against each of them, affecting integrity and availability of popup content with no confidentiality impact. CVSS 3.1 is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); no public exploit identified at time of analysis, and the vuln.today decision label is act_now.