Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubscribe tokens using deterministic data. This makes it possible for unauthenticated attackers to unsubscribe arbitrary subscribers from mailing lists via brute-forcing the unsubscribe token, granted they know the victim's email address
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| popupbuilder | Popup Builder – Create highly converting, mobile friendly marketing popups. | up to 4.4.2 | — | No fix listed | CNA |
- Popup Builder – Create highly converting, mobile friendly marketing popups. Vendorpopupbuilder Affected up to 4.4.2 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:*:*:* | — | — | popupbuilder |
- cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:*:*:* Versions — — ·popupbuilder
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13079
- 2026-10-03 Alias added: GHSA-fqr3-6hfc-hrf6
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/62b29721-0580-4e1d-824d-9b8355890248?source=cve
- https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.2/com/classes/Actions.php#L842
- https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.2/com/helpers/AdminHelper.php#L896
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444540%40popup-builder&new=3444540%40popup-builder&sfp_email=&sfph_mail=
More popupbuilder vulnerabilities
- TI-2022-00402 Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting CVSS 3.1CRITICAL 9.8
- TI-2023-05777 popup-builder < 4.2.6 - Admin+ SSRF & File Read CVSS 3.1HIGH 7.5
- TI-2024-08748 Popup Builder < 4.3.5 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2020-07226 The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL… CVSS 3.1CRITICAL 9.8
- TI-2019-10917 A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for… CVSS 3.1CRITICAL 9.8
- TI-2021-07360 Popup Builder < 4.0.7 - LFI to RCE CVSS 3.1HIGH 8.8
Sources
- CVE-2025-13079 · CVE Program
- CVE-2025-13079 · NVD
- FIRST EPSS
- GHSA-fqr3-6hfc-hrf6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences