CVE-2019-17574

CRITICALNuclei

code-atlantic popup_maker Authorization Bypass Through User-Controlled Key

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2019-17574 has a selected CVSS score of 9.1 (critical); EIP currently links 1 Nuclei template.

Description

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 23, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

popup_maker

Browse code-atlantic / popup_maker
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALPopup-Maker < 1.8.12 - Broken AuthenticationCVSS 9.1

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").

Impact

Unauthenticated attackers can gain administrative access to the WordPress site.

Remediation

Update Popup-Maker plugin to version 1.8.12 or later.

WeaknessesCWE-639
AuthorsDhiyaneshDK
Template tagscvecve2019wpscanwpwordpresswp-plugindisclosurepopup-makerauth-bypasscode-atlanticvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CPE: cpe:2.3:a:code-atlantic:popup_maker:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/popup-maker/
FOFA: body=/wp-content/plugins/popup-maker/
https://wpscan.com/vulnerability/9907 https://web.archive.org/web/20191128065954/https://blog.redyops.com/wordpress-plugin-popup-maker/ https://nvd.nist.gov/vuln/detail/CVE-2019-17574 https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.md https://wpvulndb.com/vulnerabilities/9907

Source: ProjectDiscovery

References

4