What’s Vulnerable › Vulnerabilities

CVE-2023-0772: Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-13 · updated 2026-06-17

Description

The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.

Affected products

• OptinMonster: before 2.12.2 — fixed in 2.12.2

How to fix

Upgrade to a fixed version: OptinMonster 2.12.2. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c
• https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c

Get alerted when CVE-2023-0772 or the next vulnerability affects your stack