CVE-2023-6696 is a high severity missing authorization flaw in the Popup Builder plugin for WordPress. Several functions lack a capability check, and the nonce can be taken from a logged in user profile page, so subscribers can delete subscribers and trigger blind SSRF. Versions up to 4.3.1 are affected.
What's affected
- Product: Popup Builder from Sygnoos, a WordPress plugin.
- Affected: all versions up to and including 4.3.1, per the record.
- Fixed version: not named in the record. A Trac changeset (3096000) is linked.
- Role needed: subscriber, the lowest logged in role.
The record gives a CVSS 3.1 base score of 8.1 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
Also check whether your site allows open registration. If anyone can sign up as a subscriber, the access bar for this flaw is very low.
What to do now
- Check the plugin version on each site.
- Update to a release newer than 4.3.1 and confirm in the changelog.
- Turn off open user registration if you do not need it.
- Review the plugin subscriber list for unexpected deletions, and restore from backup if needed.
- Check outbound connections from the web server for requests you cannot explain, because the record mentions blind SSRF.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-862 (Missing Authorization): The code does not check whether the caller is allowed to perform the action or see the data.
The record lists missing authorization. Some functions run for any logged in user, with only a nonce as a guard. A nonce is meant to stop forged requests, not to decide who may act, and here it can be read from a profile page.
Two outcomes are named, deleting subscribers and blind server side request forgery, where the server makes requests the caller picks and the response is not returned. Blind SSRF can still probe internal addresses. The score is 8.1, and the risk is highest on sites that let anyone register.
Quick check
Do I need to be an admin?
No. The record says subscribers can perform the actions.
Is a nonce enough protection?
No. A nonce guards against forged requests. It does not decide who is allowed to act.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
- plugins.trac.wordpress.org
- plugins.trac.wordpress.org
- www.wordfence.com
- Gold entry for CVE-2023-6696
Last reviewed: 19 October 2026.
