CVE-2020-10195 Missing authorization in n/a
Authenticated subscribers can modify plugin settings, export subscriber lists, and view system info due to missing authorization checks in admin-post actions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10195?
CVE-2020-10195 is a medium-severity missing authorization vulnerability in n/a, published on 13 Mar 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.
Weakness: CWE-200
Which versions are affected by CVE-2020-10195?
It affects 1 product.
Products include Sygnoos Popup Builder.
How do I fix CVE-2020-10195?
No fix has been published for CVE-2020-10195 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-10195 being exploited?
There is no known exploitation of CVE-2020-10195 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-0479 Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting
- CVE-2020-9006 SQL injection in n/a
- CVE-2019-14695 SQL injection in n/a
- CVE-2021-25082 Popup Builder < 4.0.7 - LFI to RCE
- CVE-2023-6696 Missing authorization in Popup Builder – Create highly converting, mobile friendly marketing popups.
Sources
Also known as GHSA-2cm7-996m-ffcv.