CVE-2025-62902: WP Popup Builder Info Disclosure Flaw

CVE-2025-62902 Overview

CVE-2025-62902 is a sensitive information disclosure vulnerability in the ThemeHunk WP Popup Builder plugin for WordPress. The flaw, classified under [CWE-497] Exposure of Sensitive System Information to an Unauthorized Control Sphere, allows unauthenticated remote attackers to retrieve embedded sensitive data from affected installations. The vulnerability impacts all versions of wp-popup-builder from initial release through version 1.3.8. Network-based exploitation requires no privileges or user interaction, making the issue trivial to weaponize against exposed WordPress sites running the plugin.

Critical Impact
Unauthenticated attackers can remotely retrieve embedded sensitive data from WP Popup Builder installations on any reachable WordPress site running version 1.3.8 or earlier.

Affected Products

ThemeHunk WP Popup Builder plugin for WordPress, all versions up to and including 1.3.8
WordPress sites with the wp-popup-builder plugin installed and active
Any WordPress deployment publicly reachable on the network running the vulnerable plugin

Discovery Timeline

2025-10-27 - CVE-2025-62902 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-62902

Vulnerability Analysis

The vulnerability stems from improper restriction of access to sensitive system information embedded within the WP Popup Builder plugin. An unauthorized actor can reach data that should remain restricted to administrative or internal contexts. The plugin exposes information through interfaces accessible without authentication, breaking the expected control sphere boundary.

The flaw aligns with CWE-497, which describes products that expose system data to actors not explicitly authorized to access it. In WordPress plugin contexts, this commonly involves REST endpoints, AJAX handlers, or accessible files that return configuration values, internal identifiers, or other embedded sensitive content. The CVSS vector indicates limited confidentiality impact only, with no integrity or availability consequences.

Root Cause

The root cause is missing or insufficient authorization controls on plugin functionality that returns embedded sensitive data. The wp-popup-builder plugin does not adequately validate whether the requester holds appropriate capabilities before serving the affected response. As a result, remote actors can query the relevant interface and receive data intended for privileged contexts. Refer to the Patchstack Vulnerability Report for technical specifics.

Attack Vector

An attacker reaches the vulnerable plugin endpoint over the network on any WordPress site running wp-popup-builder ≤ 1.3.8. The request requires no authentication, no elevated privileges, and no user interaction. The server responds with embedded sensitive information that the attacker collects for reconnaissance, secondary attacks, or aggregation across multiple sites. Verified proof-of-concept code is not publicly listed in the references.

Detection Methods for CVE-2025-62902

Indicators of Compromise

Anomalous unauthenticated HTTP requests to wp-popup-builder plugin paths under /wp-content/plugins/wp-popup-builder/ or related AJAX/REST routes
Repeated requests from a single source enumerating multiple WordPress sites for the same plugin endpoint
Outbound responses containing configuration values, internal identifiers, or other embedded plugin data to non-administrative clients

Detection Strategies

Inventory WordPress sites and identify those running wp-popup-builder at version 1.3.8 or earlier using plugin scanners or wp plugin list
Inspect web server access logs for unauthenticated requests targeting plugin-specific endpoints associated with popup configuration data
Deploy WordPress vulnerability scanners such as WPScan with up-to-date signatures referencing CVE-2025-62902

Monitoring Recommendations

Forward web access logs and WordPress audit events to a centralized SIEM and alert on bursts of anonymous requests to plugin endpoints
Monitor for sudden spikes in 200-status responses to wp-popup-builder URLs from external IPs that have never authenticated
Track plugin version drift across managed WordPress fleets to surface unpatched installations promptly

How to Mitigate CVE-2025-62902

Immediate Actions Required

Identify all WordPress installations running wp-popup-builder ≤ 1.3.8 and prioritize them for remediation
Deactivate the WP Popup Builder plugin on affected sites until a fixed version is installed
Restrict access to WordPress administrative and plugin endpoints behind a web application firewall (WAF) where feasible
Rotate any credentials, API keys, or tokens that may have been embedded in popup configurations on affected sites

Patch Information

At the time of the latest NVD update on 2026-04-27, the available references list the Patchstack Vulnerability Report as the authoritative source. Site operators should consult Patchstack and the ThemeHunk vendor channel for the latest fixed release of wp-popup-builder and upgrade beyond version 1.3.8 as soon as a patched build is available.

Workarounds

Disable or uninstall the wp-popup-builder plugin until a fixed version is published
Apply WAF rules that block unauthenticated requests to plugin-specific endpoints returning configuration data
Limit access to the WordPress site by IP allowlist or authentication during the remediation window for high-risk deployments

bash

# Identify and deactivate the vulnerable plugin via WP-CLI
wp plugin list --name=wp-popup-builder --fields=name,status,version
wp plugin deactivate wp-popup-builder
# After a fixed release is available:
wp plugin update wp-popup-builder