CVE-2020-10195

🗓️ 13 Mar 2020 15:48:58Reported by mitreType

cve🔗 web.nvd.nist.gov👁 107 Views🌐 WEB

The popup-builder plugin in WordPress allows information disclosure and settings modification, leading to privilege escalation

Reporter	Title	Published	Views	Family All 11
CNVD	WordPress popup-builder information disclosure vulnerability	17 Mar 202000:00	–	cnvd
Cvelist	CVE-2020-10195	13 Mar 202015:48	–	cvelist
EUVD	EUVD-2020-2656	7 Oct 202500:30	–	euvd
NVD	CVE-2020-10195	13 Mar 202016:15	–	nvd
OSV	CVE-2020-10195	13 Mar 202016:15	–	osv
Prion	Information disclosure	13 Mar 202016:15	–	prion
Positive Technologies	PT-2020-11968 · WordPress · Popup Builder	13 Mar 202000:00	–	ptsecurity
ThreatPost	WordPress Plugin Bug in Popup Builder Threatens 100K Websites	13 Mar 202020:53	–	threatpost
ThreatPost	WordPress Plugin Bug in Popup Builder Threatens 100K Websites	13 Mar 202020:53	–	threatpost
Tenable Nessus	Popup Builder Plugin for WordPress < 3.64.1 Multiple Vulnerabilities	16 Mar 202000:00	–	nessus

NVD

Node

sygnoos popup_builderRange<3.64.1wordpress

Source	Link
wordfence	www.wordfence.com/blog/2020/03/vulnerabilities-patched-in-popup-builder-plugin-affecting-over-100000-sites/
wpvulndb	www.wpvulndb.com/vulnerabilities/10127

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-post.php	Authenticated attacker can modify plugin settings via sgpbSaveSettings to escalate privileges.	CWE-200
action	request body	wp-admin/admin-post.php	Export subscriber list via csv_file action.	CWE-200
action	request body	wp-admin/admin-post.php	Retrieve system information including server configuration via sgpb_system_info action.	CWE-200

17 Jun 2026 02:47Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.16.3

CVSS 26.5

EPSS0.01091