Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
WordPress popup-builder 信息泄露漏洞
Vulnerability Description
WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress popup-builder 3.64.1之前版本中存在漏洞。攻击者可借助‘action’参数利用该漏洞修改插件配置，以任意用户角色访问插件功能，导出简讯订阅用户列表或获取系统配置信息（包括Web服务器配置和已安装插件的列表）。
CVSS Information
N/A
Vulnerability Type
N/A