CVE-2025-13079

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13079", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-12T16:38:13.590Z", "datePublished": "2026-02-19T03:25:14.826Z", "dateUpdated": "2026-04-08T16:57:08.174Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:08.174Z"}, "affected": [{"vendor": "popupbuilder", "product": "Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubscribe tokens using deterministic data. This makes it possible for unauthenticated attackers to unsubscribe arbitrary subscribers from mailing lists via brute-forcing the unsubscribe token, granted they know the victim's email address"}], "title": "Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/62b29721-0580-4e1d-824d-9b8355890248?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.2/com/classes/Actions.php#L842"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.2/com/helpers/AdminHelper.php#L896"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444540%40popup-builder&new=3444540%40popup-builder&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1241 Use of Predictable Algorithm in Random Number Generator", "cweId": "CWE-1241", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-10-24T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-18T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:23:14.560022Z", "id": "CVE-2025-13079", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:42:29.750Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13079", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:23:14.560022Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:23:16.247Z"}}], "cna": {"title": "Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "popupbuilder", "product": "Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.4.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-24T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-18T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/62b29721-0580-4e1d-824d-9b8355890248?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.2/com/classes/Actions.php#L842"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.2/com/helpers/AdminHelper.php#L896"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444540%40popup-builder&new=3444540%40popup-builder&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubscribe tokens using deterministic data. This makes it possible for unauthenticated attackers to unsubscribe arbitrary subscribers from mailing lists via brute-forcing the unsubscribe token, granted they know the victim's email address"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1241", "description": "CWE-1241 Use of Predictable Algorithm in Random Number Generator"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-19T03:25:14.826Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13079", "state": "PUBLISHED", "dateUpdated": "2026-02-19T17:42:29.750Z", "dateReserved": "2025-11-12T16:38:13.590Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T03:25:14.826Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.", "vendor": "popupbuilder", "versions": [{"lessThanOrEqual": "4.4.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubscribe tokens using deterministic data. This makes it possible for unauthenticated attackers to unsubscribe arbitrary subscribers from mailing lists via brute-forcing the unsubscribe token, granted they know the victim's email address"}, {"lang": "es", "value": "El plugin Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 4.4.2, inclusive. Esto se debe a que el plugin genera tokens de cancelaci\u00f3n de suscripci\u00f3n predecibles utilizando datos deterministas. Esto permite que atacantes no autenticados cancelen la suscripci\u00f3n de suscriptores arbitrarios de listas de correo mediante el ataque de fuerza bruta al token de cancelaci\u00f3n de suscripci\u00f3n, siempre que conozcan la direcci\u00f3n de correo electr\u00f3nico de la v\u00edctima."}], "id": "CVE-2025-13079", "lastModified": "2026-06-17T08:33:28.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13079", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T17:23:14.560022Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:29.823", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.2/com/classes/Actions.php#L842"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.2/com/helpers/AdminHelper.php#L896"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444540%40popup-builder&new=3444540%40popup-builder&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/62b29721-0580-4e1d-824d-9b8355890248?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1241"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.4.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.", "source": "cna", "vendor": "popupbuilder"}, "product": "popup_builder_\u2013_create_highly_converting,_mobile_friendly_marketing_popups.", "vendor": "popupbuilder"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-21T15:58:26.427616+00:00", "value": {"mitigation_remediation": ["Upgrade Popup Builder to the latest version (\u22654.4.3) to fix the predictable token issue.", "If an upgrade cannot be applied immediately, restrict access to the unsubscribe endpoint so that only authenticated users can remove subscribers, or enforce rate limiting on the endpoint to mitigate brute\u2011force attempts.", "Audit mailing lists for unauthorized removals and, if necessary, restore removed subscribers from backups or re\u2011subscribe users who were accidentally unsubscribed."], "summary": {"action": "Apply Patch", "impact": "Authorization Bypass leading to unauthorized subscriber removal"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all versions of the Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin up to and including 4.4.2, which is installed on WordPress sites that have not yet upgraded beyond that release.", "description_and_impact": "Popup Builder for WordPress has a flaw where unsubscribe tokens are generated deterministically. An unauthenticated attacker can guess a token if the victim\u2019s email address is known and use it to remove an arbitrary subscriber from a mailing list. This bypasses the plugin\u2019s authorization checks and results in data modification (unsubscribing a user) without valid credentials. The weakness is classified as CWE\u20111241, an improper authorization issue.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% suggests the chance of exploitation is low. The flaw is not currently listed in the CISA KEV catalog. Because the token is predictable and the attack requires only a known email address, an unauthenticated attacker can perform the removal by sending a simple HTTP request to the unsubscribe endpoint, possibly using brute force enumeration of the token space. The attack would be feasible if the endpoint is publicly accessible, but the overall likelihood remains low given the limited token space and the need for victim email knowledge."}}}}, "created": "2026-02-19T10:07:39.694517+00:00", "updated": "2026-04-21T16:00:13.289612+00:00", "vendors": ["popupbuilder", "popupbuilder$PRODUCT$popup_builder_\u2013_create_highly_converting,_mobile_friendly_marketing_popups.", "wordpress", "wordpress$PRODUCT$wordpress"]}