CVE-2026-12120: FireBox Popups WordPress Plugin Unauthenticated Data Exposure Vulnerability

Technical summary

CVE-2026-12120 is a sensitive information exposure vulnerability in the FireBox Popups – Increase Sales and Grow Your Email List WordPress plugin affecting versions ≤3.1.7. The vulnerability exists in improper access controls on the form export functionality, specifically via the 'form_id' parameter. Unauthenticated attackers can bypass authorization checks to export complete CSV files of form submission data. The flaw stems from insufficient authentication and authorization verification on an administrative function that should be restricted to logged-in users with proper capabilities. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies.

Business impact

This vulnerability poses a direct risk to customer data and compliance posture. Organizations using this plugin to collect email signups, survey responses, or contact information now face potential exposure of all historically submitted data. Depending on collected fields, this could include names, emails, phone numbers, and other personally identifiable information (PII). Exposure could trigger notification obligations under GDPR, CCPA, and similar regulations, resulting in legal, operational, and reputational costs. The ease of exploitation (no authentication required, predictable form IDs) increases the likelihood of opportunistic exploitation.

Affected systems

Any WordPress site running the FireBox Popups – Increase Sales and Grow Your Email List plugin version 3.1.7 or earlier is affected. The vulnerability applies regardless of WordPress version, hosting environment, or plugin configuration. Sites using this plugin for lead generation, newsletter signups, or form collection are at immediate risk of data exposure.

Exploitability

This vulnerability is highly exploitable. The attack requires no authentication, no special user interaction, and leverages a simple HTTP request with a form ID parameter. An attacker can automate exploitation by incrementing form IDs to harvest data from multiple forms. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects network-level accessibility with low attack complexity. No specialized tools are required; basic HTTP requests suffice. The primary barrier is identifying valid form IDs, which may be guessable, enumerable, or discoverable through site reconnaissance.

Remediation

Update the FireBox Popups plugin immediately to a patched version that implements proper authentication and authorization checks on the form export endpoint. Verify against the vendor advisory or plugin repository for the minimum safe version. Site administrators should also consider conducting a data breach assessment to determine if form submissions have been accessed or exported without authorization, particularly if the site has been public-facing for an extended period.

Patch guidance

Check the official FireBox Popups plugin repository on WordPress.org or the vendor's website for version 3.1.8 or later, which should include authentication and authorization fixes for the export functionality. Apply the update through the WordPress admin dashboard (Plugins > Updates) once available. Test on a staging environment first to ensure no form functionality is disrupted. Do not skip versions; apply the latest available stable release. Verify the changelog confirms remediation of this specific issue before deploying to production.

Detection guidance

Monitor web server access logs for requests to form export endpoints (typically AJAX handlers or admin-ajax.php calls) that include 'form_id' parameters, especially from non-admin IP addresses or during off-hours. Look for patterns of sequential or enumerated form_id values indicating automated scraping. Implement rate limiting on export functions. Enable WordPress security logging plugins to capture unauthorized export attempts. Query WordPress database audit logs for export actions by unauthenticated users. Conduct a forensic review of access logs spanning several months prior to patch deployment to identify potential prior compromise.

Why prioritize this

Although the CVSS base score is moderate (5.3), the practical severity is elevated due to high exploitability, complete data exposure (not partial or degraded functionality), and direct PII impact. The barrier to exploitation is near-zero—no authentication, no user interaction, no special conditions. Organizations should prioritize patching WordPress sites over other infrastructure, as these are frequently targeted and form data often contains high-value PII. The lack of KEV designation does not diminish urgency; this is a straightforward information exposure flaw ripe for mass exploitation once widely known.

Risk score, explained

The CVSS 5.3 MEDIUM score reflects the confidentiality impact (C:L) and ease of exploitation. The score does not incorporate business context (PII sensitivity, regulatory obligations, data volume) or attacker incentive. In practice, organizations handling sensitive personal data should treat this as a higher operational priority despite the moderate base score. The lack of integrity or availability impact keeps the base score measured, but the real-world risk of widespread data harvesting and regulatory exposure warrants immediate action.

Frequently asked questions