title: Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure
description: The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
problem types: CWE-639 Authorization Bypass Through User-Controlled Key
affected:
{
vendor: Unknown
product: Popup Builder by OptinMonster
versions:
status: affected, versionType: custom, version: 0, lessThan: 2.12.2
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}