CVE-2021-25082CWE-22

Popup Builder < 4.0.7 - LFI to RCE

published February 21, 2022

CVSS
—
EPSS
5%
Percentile
92.5
In the wild
Unconfirmed
What it is

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05229 · 92.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-02-21T10:45Z
EPSS history
Timeline
  • 21 FEB 10:45Z
    Popup Builder < 4.0.7 - LFI to RCE
    cvelistv5