CVE-2023-6294: popup-builder < 4.2.6 - Admin+ SSRF & File Read
The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6294?
CVE-2023-6294 has a medium severity level due to its potential for SSRF attacks in Multisite WordPress configurations.
How do I fix CVE-2023-6294?
To fix CVE-2023-6294, update the Popup Builder WordPress plugin to version 4.2.6 or later.
Who is affected by CVE-2023-6294?
CVE-2023-6294 affects WordPress sites using the Popup Builder plugin prior to version 4.2.6, specifically in Multisite configurations.
What type of attack does CVE-2023-6294 allow?
CVE-2023-6294 allows users with administrator roles to perform a Server-Side Request Forgery (SSRF) attack.
Is there a workaround for CVE-2023-6294?
A potential workaround for CVE-2023-6294 is to disable the Popup Builder plugin until an update can be applied.