The FireBox Popups WordPress plugin contains a flaw that lets any unauthenticated user download a complete CSV export of all form submissions when they provide a form_id value. Because the data includes personally identifiable information, this vulnerability can expose sensitive user data to attackers. The weakness reflects a lack of proper access controls on the CSV download endpoint and is identified as a disclosure of information.

WordPress sites using the FireBox Popups – Increase Sales and Grow Your Email List plugin from fireplugins, specifically any version up to and including 3.1.7. Versions 3.1.8 and later are not listed as affected.

The CVSS score of 5.3 classifies the issue as medium severity, and the EPSS score of less than 1% suggests that exploitation is expected to be very rare. The vulnerability is not in the CISA KEV catalog. Attackers can exploit this flaw by sending a crafted HTTP request with a valid form_id parameter, which is likely sent via GET or POST, and receive the CSV file without authenticating. Because the endpoint accepts any form_id, the attack surface is broad and does not require prior knowledge of specific forms on the site.