CVE-2022-2405

WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

Affected

WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2022-09-26

Updated

2025-05-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/50037028-2790-47ee-aae1-faf0724eb917

References

• CVE Record
• NVD entry