CVE-2022-2405 — WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

CVE-2022-2405

WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion PUBLISHED

Description (CNA)

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

Affected (CNA)

Vendor / product	Versions
Unknown / WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter	affected 1.2.9 before 1.2.9

CWE

CWE-862, CWE-352

References

https://wpscan.com/vulnerability/50037028-2790-47ee-aae1-faf0724eb917

ADP enrichment

CVE

No English description supplied.

https://wpscan.com/vulnerability/50037028-2790-47ee-aae1-faf0724eb917

CISA-ADP

No English description supplied.

No references supplied.