Description
WordPress Plugin Popup Builder-Create highly converting, mobile friendly marketing popups is prone to multiple vulnerabilities, including local file inclusion and security bypass vulnerabilities. Exploiting these issues could allow an attacker to obtain sensitive information that could aid in further attacks, or to perform otherwise restricted actions and subsequently delete/import subscribers or send out newsletters with custom content and sender. WordPress Plugin Popup Builder-Create highly converting, mobile friendly marketing popups version 3.71 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.72 or latest
References
https://www.webarxsecurity.com/multiple-vulnerabilities-wordpress-plugin-popup-builder/
https://plugins.svn.wordpress.org/popup-builder/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin Thrive Headline Optimizer Security Bypass (1.3.7.2)
XWiki Improper Authentication Vulnerability (CVE-2022-36092)
Drupal Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-6926)
WordPress Plugin WooCommerce PDF Invoice Bulk Download Cross-Site Scripting (1.0.0)