CVE-2021-25082
HIGH EXPLOITED NUCLEIPopup Builder WordPress <4.0.7 - Code Injection
Title source: llmDescription
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
Nuclei Templates (1)
WordPress Popup Builder < 4.0.7 - Remote Code Execution
CRITICALVERIFIEDby 0x_Akoko
Scores
CVSS v3
8.8
EPSS
0.1989
EPSS Percentile
95.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2022-12-19
CWE
CWE-22
Status
published
Products (1)
sygnoos/popup_builder
< 4.0.7
Published
Feb 21, 2022
Tracked Since
Feb 18, 2026