CVE-2022-4124

Popup Manager <= 1.6.6 - Unauthenticated Arbitrary Popup Deletion

The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them

Affected

Popup Manager

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 20th percentile

Published

2022-12-19

Updated

2025-04-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/60786bf8-c0d7-4d80-b189-866aba79bce2

References

• CVE Record
• NVD entry