PT-2023-16518 · Optinmonster · The Popup Builder By Optinmonster

Erwan Lr · Published 2023-03-13 · Updated 2025-02-27 · CVE-2023-0772

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Popup Builder by OptinMonster WordPress plugin versions prior to 2.12.2

Description The issue allows any authenticated users, such as subscribers, to retrieve the content of arbitrary posts, including drafts, private, or password-protected ones, due to the plugin not ensuring that the campaign loaded via certain shortcodes is actually a campaign.

Recommendations For versions prior to 2.12.2, update to version 2.12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to shortcodes that load campaigns to prevent unauthorized users from retrieving sensitive post content.

Exploit

Fix

Related Identifiers

CVE-2023-0772

Affected Products

The Popup Builder By Optinmonster

References · 5

• 🔥 https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c · Exploit
• https://osv.dev/vulnerability/CVE-2023-0772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0772 · Security Note
• https://t.me/cvenotify/112714 · Telegram Post
• https://t.me/cibsecurity/59916 · Telegram Post