CVE-2019-17574

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

9.43% chance of exploitation in the next 30 days, 95th percentile

Nuclei

critical · CWE-639

Published

2019-10-14

Updated

2024-08-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17574.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2019-17573
• CVE-2019-17576
• CVE-2019-17572
• CVE-2019-17577
• CVE-2019-17571
• CVE-2019-17578