PT-2020-20425 · WordPress · Popup Builder

Yeraisci · Published 2020-02-17 · Updated 2021-07-21 · CVE-2020-9006

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Popup Builder plugin versions 2.2.8 through 2.6.7.6

Description The issue allows for SQL injection via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable in the sgImportPopups function in sg popup ajax.php. This enables the creation of an arbitrary WordPress Administrator account, potentially leading to Remote Code Execution since Administrators can run PHP code on WordPress instances.

Recommendations For versions 2.2.8 through 2.6.7.6, update to the 3.x branch of the Popup Builder plugin to resolve the issue.

Exploit

Fix

RCE

SQL injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-89

CWE-502

Related Identifiers

CVE-2020-9006

Affected Products

Popup Builder

References · 7

• 🔥 https://plugins.trac.wordpress.org/browser/popup-builder/tags/2.2.8/files/sg_popup_ajax.php#L69 · Exploit
• 🔥 https://zeroauth.ltd/blog/2020/02/16/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9006 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9006 · Vendor Advisory
• https://wpvulndb.com/vulnerabilities/10073 · Note
• https://t.me/cvenotify/1081 · Telegram Post
• https://wordpress.org/plugins/popup-builder/#developers · Note