CVE-2019-17574

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").

• CWE-639

• http://blog.redyops.com/wordpress-plugin-popup-maker/Exploit, Third Party Advisory
• https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.mdRelease Notes
• https://wpvulndb.com/vulnerabilities/9907Third Party Advisory
• http://blog.redyops.com/wordpress-plugin-popup-maker/Exploit, Third Party Advisory
• https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.mdRelease Notes
• https://wpvulndb.com/vulnerabilities/9907Third Party Advisory

Published

Oct 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17569The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8…4.8
• CVE-2019-1757A vulnerability in the Cisco Smart Call Home feature of Cisc…5.9
• CVE-2019-17570An untrusted deserialization was found in the org.apache.xml…9.8
• CVE-2019-17571Included in Log4j 1.2 is a SocketServer class that is vulner…9.8
• CVE-2019-17572In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic …5.3
• CVE-2019-17573By default, Apache CXF creates a /services page containing a…6.1
• CVE-2019-17575A file-rename filter bypass exists in admin/media/rename.php…7.2
• CVE-2019-17576An issue was discovered in Dolibarr 10.0.2. It has XSS via t…5.4
• CVE-2019-17577An issue was discovered in Dolibarr 10.0.2. It has XSS via t…5.4
• CVE-2019-17578An issue was discovered in Dolibarr 10.0.2. It has XSS via t…5.4
• CVE-2019-17579SonarSource SonarQube before 7.8 has XSS in project links on…6.1
• CVE-2019-1758A vulnerability in 802.1x function of Cisco IOS Software on …4.7