CVE-2019-17574 - An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress

Back Back to CVE browser

CRITICAL

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress

Published Oct 14, 2019

9.1

CRITICAL

CVSS 3.1

EPSS 9.43%

Description

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (3)

http://blog.redyops.com/wordpress-plugin-popup-maker/
x_refsource_MISCExploitThird Party Advisory
https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.md
x_refsource_MISCRelease Notes
https://wpvulndb.com/vulnerabilities/9907
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://blog.redyops.com/wordpress-plugin-popup-maker/		x_refsource_MISCExploitThird Party Advisory
https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.md		x_refsource_MISCRelease Notes
https://wpvulndb.com/vulnerabilities/9907		x_refsource_MISCThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 14, 2019

Updated Aug 5, 2024

Reserved Oct 14, 2019

Link CVE-2019-17574

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-17574

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-17574