PT-2020-11968 · WordPress · Popup Builder

Ramuel Gall · Published 2020-03-13 · Updated 2025-05-07 · CVE-2020-10195

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions popup-builder plugin versions prior to 3.64.1

Description The issue allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to "wp-admin/admin-post.php", an authenticated attacker with minimal permissions can modify the plugin's settings to allow arbitrary roles access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb system info.

Recommendations For versions prior to 3.64.1, update to version 3.64.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-post.php" endpoint or disabling the sgpbSaveSettings, csv file, and sgpb system info actions until a patch is applied. Restrict access to the com/classes/Actions.php file to minimize the risk of exploitation. Avoid using the action parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

LPE

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-10195

Affected Products

Popup Builder

References · 6

• 🔥 https://wordfence.com/blog/2020/03/vulnerabilities-patched-in-popup-builder-plugin-affecting-over-100000-sites · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-10195 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10195 · Vendor Advisory
• https://wpvulndb.com/vulnerabilities/10127 · Note
• https://t.me/cvenotify/1637 · Telegram Post
• https://t.me/cvenotify/121213 · Telegram Post