Beta

Report

Popup by Supsystic <= 1.10.19 is vulnerable to Unauthenticated Subscriber Email Addresses Disclosure

Unauthenticated
Published
2023-10-17

The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it possible for authenticated attackers with subscriber level access or higher to extract sensitive data including subscriber email addresses. CVE-2023-51353 appears to be a duplicate of this issue.

CVSS

Score:5.3

Severity:Medium

Version: 1.10.19

There is a patch available in v1.10.20 and we strongly recommend you update to this version as soon as possible.