CVE-2026-12120 is a sensitive information exposure vulnerability (CWE-200) in the FireBox Popups – Increase Sales and Grow Your Email List WordPress plugin. The issue exists in all versions up to and including 3.1.7 and is triggered via the 'form_id' parameter, which allows unauthenticated attackers to download CSV exports of form submissions. This can lead to unauthorized access to personally identifiable information submitted by users. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and confidentiality impact limited to partial information disclosure.

An unauthenticated attacker can exploit this vulnerability to obtain sensitive user data submitted through forms managed by the plugin. This exposure includes personally identifiable information, potentially leading to privacy violations and data breaches. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor the vendor's communications for updates and consider restricting access to the affected plugin or disabling it until a fix is available.