FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter

An unauthenticated attacker can send a crafted HTTP request to the WordPress admin area with a `form_id` parameter set to any valid form identifier. The `maybeExportSubmissions()` method in the Admin class processes this parameter without verifying user capabilities or a nonce, queries the database for all submissions matching that form ID, and streams a CSV file containing all submitted data — including personally identifiable information (PII) — directly to the attacker. No authentication or prior interaction is required, making this a trivial data exfiltration vector.

The vulnerability resides in the `maybeExportSubmissions()` method within `Inc/Core/Admin/Admin.php` (line 42 in version 3.1.6). This method is called from the constructor and directly uses the user-supplied `form_id` parameter to query and export form submissions without any capability or nonce check, allowing unauthenticated access to the CSV export functionality.

The advisory does not include a published patch, but the root cause is clear: the `maybeExportSubmissions()` method lacks any capability check (e.g., `current_user_can()`) or nonce verification before exporting submissions. A proper fix would require verifying that the requesting user has the appropriate administrative capability (such as `manage_options`) and validating a nonce before processing the export. Until a patch is applied, the plugin remains vulnerable to unauthenticated data exfiltration.