CVE-2024-2541

CVE-2024-2541 describes a Sensitive Information Exposure vulnerability in the Popup Builder WordPress plugin, affecting all versions up to and including 4.3.3. This flaw allows unauthenticated attackers to extract sensitive subscriber data, such as names and email addresses, after an administrator has used the Subscribers Import feature with a CSV file. Rated with a CVSS score of 7.5 (High), the vulnerability is easily exploitable over the network with low attack complexity, posing a significant risk of data compromise. Currently, there is no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or ExploitDB entries, and it has received minimal community discussion or media coverage.