CVE-2023-0772
Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
The OptinMonster plugin for WordPress is vulnerable to unauthorized access of data due to insufficient post type validation on the 'prepare_campaign' function in versions up to 2.12.1. This makes it possible for authenticated attackers with subscriber-level access, and above, to access potentially sensitive information due to lack of protections and information restrictions that let campaign information or even private post and content information to be leaked.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-02-10 CVE Reserved
- 2023-03-03 CVE Published
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- 2024-10-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-639: Authorization Bypass Through User-Controlled Key
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c | 2024-08-02 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Optinmonster Search vendor "Optinmonster" | Optinmonster Search vendor "Optinmonster" for product "Optinmonster" | < 2.12.2 Search vendor "Optinmonster" for product "Optinmonster" and version " < 2.12.2" | wordpress |
Affected
| ||||||