WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control vulnerability
CVE-2023-51353

9.8CRITICAL

Key Information:

Vendor
WordPress
Status
Popup By Supsystic
Vendor
CVE Published:
9 December 2024

Summary

A missing authorization vulnerability in the Popup by Supsystic plugin exposes users to potential unauthorized access due to incorrectly configured access control security levels. This flaw affects versions of the plugin up to 1.10.19, enabling attackers to exploit this weakness and gain unauthorized control over sensitive functionalities.

Affected Version(s)

Popup by Supsystic <= 1.10.19

References

https://patchstack.com/database/wordpress/plugin/popup-by...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdi Pranata (Patchstack Alliance)
.