Sensitive Data Exposure Vulnerability in Popup Builder Plugin

CVE-2024-2541

Summary

The Popup Builder plugin for WordPress, used for creating dynamic popups, is affected by a vulnerability that allows unauthenticated attackers to expose sensitive information. This vulnerability is present in all versions up to and including 4.3.3, specifically through the plugin's Subscribers Import feature. When administrators import subscriber data from a CSV file, critical personal information such as first names, last names, email addresses, and potentially other personally identifiable information could be extracted by unauthorized users. As a result, this exposes subscribers to privacy risks and data breaches, making it crucial for site owners to be aware of this vulnerability and take appropriate action.

References