Is CVE-2020-10195 actively exploited?

No active exploitation of CVE-2020-10195 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-10195 be exploited remotely?

Yes. CVE-2020-10195 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-10195?

CVE-2020-10195 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2020-10195

MEDIUM

CVE-2020-10195

CWE-200Published: March 13, 2020· Updated: Jun 17, 2026

6.3

CVSS v3.1

Official Description

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.

NVD Source

Technical Analysis

CVE-2020-10195 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.