Description
WordPress Plugin Popup Builder-Create highly converting, mobile friendly marketing popups is prone to multiple vulnerabilities, including local file inclusion and security bypass vulnerabilities. Exploiting these issues could allow an attacker to obtain sensitive information that could aid in further attacks, or to perform otherwise restricted actions and subsequently delete/import subscribers or send out newsletters with custom content and sender. WordPress Plugin Popup Builder-Create highly converting, mobile friendly marketing popups version 3.71 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.72 or latest
References
https://www.webarxsecurity.com/multiple-vulnerabilities-wordpress-plugin-popup-builder/
https://plugins.svn.wordpress.org/popup-builder/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin WordPress Popular Posts TimThumb Arbitrary File Upload (2.1.4)
WordPress Plugin Category Grid View Gallery Cross-Site Scripting (2.3.3)
Apache Tomcat Improper Input Validation Vulnerability (CVE-2014-0095)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-4298)