CVE-2020-9006

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)

• CWE-89
• CWE-502

• https://plugins.trac.wordpress.org/browser/popup-builder/tags/2.2.8/files/sg_popup_ajax.php#L69Exploit, Third Party Advisory
• https://wordpress.org/plugins/popup-builder/#developersRelease Notes
• https://wpvulndb.com/vulnerabilities/10073Third Party Advisory
• https://zeroauth.ltd/blog/2020/02/16/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization/Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/popup-builder/tags/2.2.8/files/sg_popup_ajax.php#L69Exploit, Third Party Advisory
• https://wordpress.org/plugins/popup-builder/#developersRelease Notes
• https://wpvulndb.com/vulnerabilities/10073Third Party Advisory
• https://zeroauth.ltd/blog/2020/02/16/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization/Exploit, Third Party Advisory

Published

Feb 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9000An issue was discovered in iPortalis iCS 7.1.13.0. Attackers…7.5
• CVE-2020-9001Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-9002An issue was discovered in iPortalis iCS 7.1.13.0. An attack…7.5
• CVE-2020-9003A stored XSS vulnerability exists in the Modula Image Galler…5.4
• CVE-2020-9004A remote authenticated authorization-bypass vulnerability in…8.8
• CVE-2020-9005meshsystem.dll in Valve Dota 2 through 2020-02-17 allows rem…7.8
• CVE-2020-9007Codoforum 4.8.8 allows self-XSS via the title of a new topic…5.4
• CVE-2020-9008Stored Cross-site scripting (XSS) vulnerability in Blackboar…5.4
• CVE-2020-9009The ShipStation.com plugin 1.1 and earlier for CS-Cart allow…3.7
• CVE-2020-9012A cross-site scripting (XSS) vulnerability in the Import Peo…6.1
• CVE-2020-9013Arvato Skillpipe 3.0 allows attackers to bypass intended pri…4.3
• CVE-2020-9014In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) a…5.5