CVE-2024-2541 is a medium severity (CVSS 5.3) sensitive information exposure in the Popup Builder WordPress plugin, all versions up to and including 4.3.6. The Subscribers Import feature can leak imported subscriber data to unauthenticated visitors. The record names no fixed version, so check the plugin changelog.
What's affected
The Popup Builder plugin for WordPress, all versions up to and including 4.3.6, per the record. The exposure is through the Subscribers Import feature. It matters only after an administrator has imported subscribers from a CSV file, and the exposed data can include first name, last name and email address, and possibly other personal details.
The NVD record scores it 5.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, published 2024-08-29. The weakness is classed as CWE-200 (exposure of sensitive information).
The record does not state a fixed version. Its references point to the plugin source on the WordPress plugin repository and a Wordfence entry that I could not load. Read the plugin changelog and the Wordfence entry for the first release after 4.3.6 that addresses this.
How to check if you're exposed
Check the installed version of the plugin in the WordPress admin under Plugins, or with WP-CLI:
wp plugin list --name=popup-builder --fields=name,status,version
Anything at 4.3.6 or below is in the affected range. Also ask whether anyone has ever used the Subscribers Import feature. If not, the exposure described in the record does not apply to your data.
What to do now
- Check the installed Popup Builder version with the command above.
- Update the plugin to the newest release in the WordPress repository and read its changelog for this issue.
- If you imported subscribers from a CSV, find and remove the leftover import data you no longer need.
- Treat subscriber lists as personal data and assess whether disclosure notices apply to you.
- Consider removing the plugin if you no longer use its popups.
Why it matters
The weakness is exposure of sensitive information. Data that was meant to be seen only by an administrator ends up reachable by someone who is not signed in. In this case the data is subscriber details such as names and email addresses, which are personal data and may carry legal duties if exposed.
Exposure bugs are quiet. Nothing crashes and nothing is written, so there is rarely an obvious sign. That makes version tracking and removing stale exports more important than usual.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect me if I never imported subscribers?
The record says exposure follows an administrator importing subscribers by CSV. Without an import there is no imported data to expose, but update anyway.
Sources
Last reviewed: 19 October 2026.
