PT-2024-15054 · WordPress · The Popup Builder

Lucio Sá · Published 2024-06-15 · Updated 2024-08-06 · CVE-2023-6696

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress versions up to, and including, 4.3.1

Description The issue arises from a missing capability check on several functions, allowing unauthorized access to functionality. Although some functions include a nonce check, the nonce can be obtained from the profile page of a logged-in user. This enables subscribers to perform actions such as deleting subscribers and conducting blind Server-Side Request Forgery.

Recommendations For versions up to, and including, 4.3.1, update to a version higher than 4.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the functions that contain the missing capability check until a patch is available. Additionally, restrict access to the profile page of logged-in users to minimize the risk of nonce exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-6696

Affected Products

The Popup Builder

References · 7

• https://osv.dev/vulnerability/CVE-2023-6696 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.2.3/com/classes/Ajax.php · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/9f86ec30-7a9d-4c36-8559-bde331c8b958?source=cve · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-6696 · Security Note
• https://plugins.trac.wordpress.org/changeset/3096000/popup-builder/trunk/com/classes/Ajax.php · Patch
• https://t.me/cvenotify/83379 · Telegram Post
• https://t.me/cvenotify/89435 · Telegram Post