PT-2026-50631 · Fireplugins · Firebox Popups – Increase Sales/Grow Your Email List

Duc Manh · Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-12120

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via the 'form id' parameter. This makes it possible for unauthenticated attackers to extract download a full CSV export of all form submissions — including any personally identifiable information submitted by users — for any arbitrary form id.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-12120

Affected Products

Firebox Popups – Increase Sales/Grow Your Email List

References · 10

• https://plugins.trac.wordpress.org/browser/firebox/tags/3.1.6/Inc/Core/Admin/Admin.php#L156 · Note
• https://plugins.trac.wordpress.org/browser/firebox/tags/3.1.6/Inc/Core/Admin/Admin.php#L42 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/54f939f9-2853-401a-adc0-5b727da5179b?source=cve · Note
• https://plugins.trac.wordpress.org/browser/firebox/tags/3.1.6/Inc/Framework/init.php#L254 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3572719%40firebox&new=3572719%40firebox&sfp_email=&sfph_mail=#file38 · Note
• https://plugins.trac.wordpress.org/browser/firebox/tags/3.1.7/Inc/Core/Plugin.php#L217 · Note
• https://plugins.trac.wordpress.org/browser/firebox/tags/3.1.7/Inc/Framework/init.php#L254 · Note
• https://plugins.trac.wordpress.org/browser/firebox/tags/3.1.6/Inc/Core/Plugin.php#L217 · Note
• https://plugins.trac.wordpress.org/browser/firebox/tags/3.1.7/Inc/Core/Admin/Admin.php#L42 · Note
• https://plugins.trac.wordpress.org/browser/firebox/tags/3.1.7/Inc/Core/Admin/Admin.php#L156 · Note