The Popup Builder plugin for WordPress, versions up to and including 4.3.6, contains a sensitive information exposure vulnerability (CWE-200) through its Subscribers Import feature. An unauthenticated attacker can exploit this flaw to extract subscriber data imported by an administrator via CSV files. The exposed data may include personally identifiable information such as first name, last name, and email addresses. The CVSS 3.1 base score is 5.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, and no user interaction needed.

This vulnerability allows unauthorized actors to access sensitive subscriber information stored or processed by the Popup Builder plugin. The exposure of personally identifiable information could lead to privacy violations and potential misuse of subscriber data. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Administrators should monitor the vendor's advisory for updates and apply any official fixes once released. Until then, limiting access to the Subscribers Import feature and restricting administrative privileges may reduce exposure risk.