vulnerability

WordPress Plugin: popup-by-supsystic: CVE-2023-46197: Exposure of Sensitive Information to an Unauthorized Actor

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:S/C:P/I:N/A:N)

Published

Oct 18, 2023

Added

May 15, 2025

Modified

May 4, 2026

Description

The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it possible for authenticated attackers with subscriber level access or higher to extract sensitive data including subscriber email addresses. CVE-2023-51353 appears to be a duplicate of this issue.

Solution

popup-by-supsystic-plugin-cve-2023-46197

References

https://www.cve.org/CVERecord?id=CVE-2023-46197
https://www.wordfence.com/threat-intel/vulnerabilities/id/f458663f-6b1a-4acd-b2db-c66d7a915ab7?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50440
CVE-2023-46197
https://attackerkb.com/topics/CVE-2023-46197
CWE-22
EUVD-EUVD-2023-50440

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report