Attack Vectors

CVE-2025-13079 affects the WordPress plugin Popup Builder – Create highly converting, mobile friendly marketing popups. (slug: popup-builder) in versions up to and including 4.4.2. The severity is Medium (CVSS 5.3).

The primary attack path is an unauthenticated actor abusing the plugin’s unsubscribe mechanism. Because unsubscribe tokens are generated predictably using deterministic data, an attacker who knows a victim’s email address can attempt to brute-force the token and trigger an unsubscribe action without being logged in.

This is especially relevant for organizations using popups to capture leads and run email-driven campaigns, because the unsubscribe workflow is designed to be accessible (to allow recipients to opt out) and may therefore be reachable from the public internet.

Security Weakness

The underlying issue is an improper authorization condition caused by the plugin generating predictable unsubscribe tokens (deterministic rather than securely random). This can enable authorization bypass for subscriber removal actions.

In practical business terms: the control that should ensure “only the intended recipient can unsubscribe” can be weakened when the token can be guessed. While the CVSS vector indicates no user interaction is required and the attacker needs no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the impact is mainly on integrity (I:L), not data exposure.

Remediation: update Popup Builder to version 4.4.3 or a newer patched release.

Technical or Business Impacts

Marketing performance risk: unauthorized unsubscribes reduce list size, weaken segmentation quality, and can directly impact campaign ROI, lead nurturing, and pipeline contribution—especially if high-value contacts are targeted.

Revenue and forecasting risk: email lists are often treated as an owned growth channel. Unexpected subscriber loss can distort metrics like deliverability trends, engagement rates, and month-over-month performance used in planning by the CEO, COO, and CFO.

Brand and customer-experience risk: if legitimate subscribers are removed without intending to opt out, your organization may see confusion, support tickets, and reputational damage (“I stopped receiving updates” scenarios).

Compliance and audit considerations: while this vulnerability does not indicate data theft (CVSS shows C:N), it can still create process concerns around consent management and record accuracy. Compliance teams may need to document the incident risk and demonstrate timely patching and control validation.

Recommended action: confirm your installed version of Popup Builder – Create highly converting, mobile friendly marketing popups.; if it is 4.4.2 or older, prioritize upgrading to 4.4.3+, then review unsubscribe logs/metrics for anomalies and ensure only intended unsubscribe requests are being honored going forward.

Similar Attacks

Predictable or guessable tokens have been a recurring cause of unauthorized actions across many platforms. Here are a few widely documented examples:

PortSwigger: Access control vulnerabilities (including insecure direct object references and token/identifier weaknesses)

OWASP: Insecure Direct Object Reference (IDOR) prevention cheat sheet

OWASP: Forgot password guidance (emphasizing secure, unguessable tokens for account actions)