CVE-2021-25082 — Popup Builder < 4.0.7 - LFI to RCE
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion …
Published: 2022-02-21 · CVSS: Unscored
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7