title: popup-builder < 4.2.6 - Admin+ SSRF & File Read
description: The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
vendor: Unknown
product: Popup Builder
versions:
status: affected, versionType: semver, version: 0, lessThan: 4.2.6
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}