CVE-2026-12120: FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter
The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via the 'formid' parameter. This makes it possible for unauthenticated attackers to extract download a full CSV export of all form submissions — including any personally identifiable information submitted by users — for any arbitrary formid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
FireBox Popups – Increase Sales and Grow Your Email Listfrom your environment.Uninstall the FireBox Popups plugin if it is not required to eliminate the vulnerable code path that exposes CSV exports of form submissions via the 'form_id' parameter.
- Configuration
Disable the plugin's CSV export feature or require authentication/authorization for any endpoint that accepts the 'form_id' parameter so unauthenticated users cannot download form submission exports.
FireBox Popups plugin CSV export / public access to export endpoint (form_id parameter) = disabled / require authentication - Compensating control
Deploy a WAF rule or firewall ACL to block unauthenticated requests to the plugin's export endpoints or to requests containing the 'form_id' parameter; restrict access to the export functionality to trusted admin IP addresses only.
- Operational
Audit access logs for evidence of CSV export/downloads for any form_id, determine whether any personally identifiable information was exfiltrated, and follow incident response procedures (notify affected users and regulators as applicable).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12120?
The severity of CVE-2026-12120 is medium with a score of 5.3.
What information can be exposed in CVE-2026-12120?
CVE-2026-12120 allows unauthenticated attackers to extract sensitive information through a full CSV export due to the 'form_id' parameter vulnerability.
How can CVE-2026-12120 be mitigated?
To mitigate CVE-2026-12120, update the FireBox Popups plugin to version 3.1.8 or later.
Who is affected by CVE-2026-12120?
All users of the FireBox Popups plugin for WordPress up to and including version 3.1.7 are affected by CVE-2026-12120.
Is authentication required to exploit CVE-2026-12120?
No, CVE-2026-12120 can be exploited by unauthenticated attackers.