How severe is CVE-2023-0772?

CVE-2023-0772 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2023-0772 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-0772?

CVE-2023-0772 affects Optinmonster. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-0772?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-0772 published?

CVE-2023-0772 was published on 2023-03-13 and last updated on 2026-06-17.

CVE-2023-0772

CVE-2023-0772 is a medium-severity vulnerability in Optinmonster with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (52nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Optinmonster
Published: 2023-03-13
Last modified: 2026-06-17

Description

The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.

Frequently asked questions

What is CVE-2023-0772?: The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
How severe is CVE-2023-0772?: CVE-2023-0772 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2023-0772 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-0772?: CVE-2023-0772 affects Optinmonster. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-0772?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-0772 published?: CVE-2023-0772 was published on 2023-03-13 and last updated on 2026-06-17.

References

https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c

Affected products (1)

cpe:2.3:a:optinmonster:optinmonster:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Optinmonster

CVE-2021-39341 — High (CVSS 8.2): The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates…
CVE-2024-4045 — Medium (CVSS 6.4): The Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for…
CVE-2021-39325 — Medium (CVSS 6.1): The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation…
CVE-2016-10996 — Medium (CVSS 5.3): The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce…

All CVEs affecting Optinmonster →