CVE-2022-2405: WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion
Published Sep 26, 2022
·Updated
The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup
Affected Software
1 affected component
ThemeHunk Wp Popup Builder Wordpress<1.2.9
Event History
Sep 26, 2022
CVE Published
via MITRE·12:35 PM
Data Sourced
via MITRE·12:35 PM
DescriptionWeakness
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-2405.
2
What is the severity of CVE-2022-2405?
The severity of CVE-2022-2405 is medium with a severity value of 4.3.
3
What is the affected software for CVE-2022-2405?
The affected software for CVE-2022-2405 is the WP Popup Builder WordPress plugin before version 1.2.9.
4
What is the impact of CVE-2022-2405?
CVE-2022-2405 allows authenticated users, such as subscribers, to delete arbitrary Popups.
5
How can I fix CVE-2022-2405?
To fix CVE-2022-2405, update the WP Popup Builder plugin to version 1.2.9 or later.