WordPress Plugin Vulnerabilities

Popup by Supsystic < 1.10.20 - Missing Authorization to Sensitive Information Exposure

Description

The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it possible for authenticated attackers with subscriber level access or higher to extract sensitive data including subscriber email addresses. CVE-2023-51353 appears to be a duplicate of this issue.

Affects Plugins

Plugin icon
popup-by-supsystic
Fixed in 1.10.20

References

CVE
CVE-2023-46197
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f458663f-6b1a-4acd-b2db-c66d7a915ab7

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Rafshanzani Suhada
Verified
No
WPVDB ID
1eb27a76-5228-48d5-bad8-91928809cadc

Timeline

Publicly Published
2023-10-18 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-01-12 (about 2 years ago)

Other

Published
Title
Published
2025-12-11
Title
Guest Support < 1.3.0 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpoint
Published
2024-11-26
Title
ProfilePress < 4.15.19 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Published
2024-08-08
Title
PDF Builder for WPForms < 1.2.117 - Unauthenticated Full Path Disclosure
Published
2025-10-10
Title
WP Gmail SMTP <= 1.0.7 - Sensitive Information Exposure
Published
2025-12-12
Title
Ultimate Auction <= 4.3.2 - Unauthenticated Information Exposure