CVE-2021-25082
Popup Builder < 4.0.7 - LFI to RCE
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 5.4%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
21 Feb 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
Affected products
Unknown · Popup Builder – Create highly converting, mobile friendly marketing popups.Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →