VULNERABILITY INTELLIGENCE

CVE-2022-2405

CVSS score4.3 MEDIUM
EPSS probability0.32%
CISA KEVNot currently listed
Published2022-09-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

Weakness classification

  • contact@wpscan.com: CWE-352
  • nvd@nist.gov: CWE-352

Primary references