As elaborated in their blog post, an unauthenticated stored cross-site scripting (XSS) existed in the plugin. Regarding the flaw, the researchers stated,
It registered an AJAX hook, wp_ajax_nopriv_sgpb_autosave, intended to allow auto-saving of draft popups.
Unfortunately, this hook was available to unprivileged users, and the function it called lacked nonce checks or capability checks.
Any logged-in user could easily exploit the bug by sending a malicious POST request and inserting a malicious JavaScript payload to the plugin settings. The payload would then execute every time a user visited a page that displayed a popup.
In this way, an attacker could exploit the vulnerability to execute various malicious activities. According to the researchers,
Typically, attackers use a vulnerability like this to redirect site visitors to malvertising sites or steal sensitive information from their browsers, though it could also be used for site takeover if an administrator visited or previewed a page containing the infected popup while logged in.They went to say there also are numerous other vulnerabilities that could allow users with minimal permissions to gain access to subscriber details.
Fortunately, the developers quickly responded to the researchers and worked out a fix for the flaw. Consequently, the bug that affected all the then available plugin versions received a fix with the release of Popup Builder plugin v.3.64.1.
Presently, the plugin boasts over 100,000 active installations. It means that the vulnerability also posed a threat to thousands of websites. Now that a fix is out, users must ensure updating their sites to the latest plugin version to avoid exploitation.
Let us know your thoughts in the comments.