CVE-2022-2405CWE-352CWE-862

WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

Medium · published September 26, 2022

CVSS v3.1
4.3
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.7th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2022-09-26T12:35Z
EPSS history
Timeline
  • 26 SEP 12:35Z
    WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion
    cvelistv5