CVE-2024-2544 Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions

What is CVE-2024-2544?

CVE-2024-2544 is a high-severity missing authorization vulnerability in popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups., published on 15 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions, such as deleting subscribers, and importing subscribers to conduct stored cross-site scripting attacks.

Weakness: CWE-862

Which versions are affected by CVE-2024-2544?

It affects 1 product.

Products include Sygnoos Popup Builder.

How do I fix CVE-2024-2544?

No fix has been published for CVE-2024-2544 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-2544 being exploited?

There is no known exploitation of CVE-2024-2544 in the wild and no public exploit code.

Other vulnerabilities in popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups.

• CVE-2022-0479 Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting Critical 9.8
• CVE-2020-9006 SQL injection in n/a Critical 9.8
• CVE-2019-14695 SQL injection in n/a Critical 9.8
• CVE-2021-25082 Popup Builder < 4.0.7 - LFI to RCE High 8.8
• CVE-2023-6696 Missing authorization in Popup Builder – Create highly converting, mobile friendly marketing popups. High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f6rh-pgcv-pqrj.