CVE-2024-2544 HIGH

CVE-2024-2544: Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions

Vendor Popupbuilder
Product Popup Builder – Create highly converting, mobile friendly marketing popups.
Weakness CWE-862 · Missing authorization
Published June 15, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions, such as deleting subscribers, and importing subscribers to conduct stored cross-site scripting attacks.

Key dates

02Disclosure timeline

June 15, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-47163 Quest Bot: Unprivileged users can create and remove AutoMod rules. CVE-2025-42952 Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis CVE-2023-46607 WordPress WP iCal Availability plugin <= 1.0.3 - Broken Access Control vulnerability CVE-2025-3124 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names CVE-2025-4047 Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View