CVE-2021-25082: vulnerability in Popup Builder – Create highly converting…
Popup Builder < 4.0.7 - LFI to RCE
Published · Updated
Follow this CVE+ Monitor Popup Builder – Create highly converting, mobile friendly marketing popups.
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
40Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 5.2%
from disclosure to weapon
Published on NVDFeb 21
VulnCheck+301d
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
Affected products
Unknown · Popup Builder – Create highly converting, mobile friendly marketing popups.Related CVEs — Popup Builder – Create highly converting…
In the same product, most dangerous first.