This vulnerability (CVE-2024-3897) affects the Popup Box – Create Countdown, Coupon, Video, Contact Form Popups WordPress plugin due to a missing capability check on the ays_pb_create_author AJAX action. This missing authorization allows unauthenticated attackers to enumerate all emails registered on the affected WordPress site. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild. No patch or official vendor advisory is currently provided, and the plugin is not a cloud service.

The vulnerability allows unauthorized disclosure of registered email addresses on the affected WordPress site, potentially leading to privacy violations or targeted phishing attacks. There is no impact on data integrity or system availability. The exposure is limited to email enumeration only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider disabling or restricting access to the vulnerable AJAX action if possible, or temporarily deactivating the plugin to prevent exploitation.