PSIRT Vulnerability #CVE-2019-17574

Hi @nikhilranpara-1 ,

We have informed our developers about that, and we will inform you as soon as we get some feedback.

You may let us know if you have more questions in the meantime.

Thanks!

@nikhilranpara-1 – Yes, that is quite old, though at first glance the versions looked similar, it was in v1.8.12, we are on v1.18.2, lots of releases since then.

Here is the changelog in question, patched and released days prior to that publication: https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.md#v1813—10112019

https://github.com/PopupMaker/Popup-Maker/commit/974f6f395d052db4b493d616130b4538f9ffcdfd

You will still get a curl response from those requests, but it will be the WP permission denied or login screens. They all require a valid nonce after that patch.

Hope that helps. Let us know if there is something we are missing.

Thanks for the feedback.

We have checked it in different operating system and found that it is not working as expected in Linux system. It is retrieving all the information about server while accessing from Linux system.

Also, in windows it is creating a connection but not sharing server information. I have additional information to share with you however I do not wish to share it publicly.

I’ve uploaded response sample in WeTransfer for your reference, please download the file from the link below.

https://we.tl/t-CGCfXwFTAr

Please let me know if you need more information. Thanks.