Read the docs
TI-2024-03637 Aliases CVE-2024-3897GHSA-3xgx-x66j-ggxc

Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure

Priority LOW 31CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registered on the website.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00623 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ays ProPopup Box – Create Countdown, Coupon, Video, Contact Form Popupsup to 4.3.6—No fix listedCNA
  • Popup Box – Create Countdown, Coupon, Video, Contact Form Popups VendorAys Pro Affected up to 4.3.6 Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:ays-pro:popup_box:*:*:*:*:*:wordpress:*:*——Ays Pro
  • cpe:2.3:a:ays-pro:popup_box:*:*:*:*:*:wordpress:*:* Versions — — ·Ays Pro

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3897
  2. 2026-10-03 Alias added: GHSA-3xgx-x66j-ggxc
  3. 2026-11-05 EPSS moved to the 50th–90th percentile

References

Other 2

  • TI-2021-07210 Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2023-09325 SQL injection in Survey Maker WordPress Plugin CVSS 3.1HIGH 8.8
  • TI-2024-09849 Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id CVSS 3.1HIGH 7.5
  • TI-2024-07151 AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls CVSS 3.1HIGH 7.5
  • TI-2024-07150 AI Chatbot with ChatGPT by AYS <= 2.0.9 - Unauthenticated OpenAI Key Disclosure CVSS 3.1HIGH 7.5
  • TI-2023-05660 Quiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure CVSS 3.1MEDIUM 5.3
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences