PT-2022-9638 · WordPress · Popup Builder

Jrxnm + 1 · Published 2022-02-21 · Updated 2025-12-18 · CVE-2021-25082

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Popup Builder WordPress plugin versions prior to 4.0.7

Description The Popup Builder WordPress plugin does not properly check and clean the sgpb type parameter before it is used in a require statement. This can lead to a Local File Inclusion issue. Because the start of the input string can be controlled, this issue can also lead to Remote Code Execution (RCE) through the use of wrappers like PHAR.

Recommendations Update to Popup Builder WordPress plugin version 4.0.7 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-25082

Affected Products

Popup Builder

References · 6

• 🔥 https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25082 · Security Note
• https://plugins.trac.wordpress.org/changeset/2659117 · Note
• https://twitter.com/pdnuclei_bot/status/2001502714933702749 · Twitter Post
• https://t.me/cvenotify/27493 · Telegram Post