CVE-2022-0424

🗓️ 09 May 2022 16:50:28Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 104 Views🌐 WEB

The Popup by Supsystic WordPress plugin before 1.10.9 allows unauthenticated attackers to retrieve email addresses

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2022-0424	9 May 202217:15	–	attackerkb
Circl	CVE-2022-0424	9 May 202220:36	–	circl
CNNVD	WordPress plugin Popup by Supsystic 访问控制错误漏洞	9 May 202200:00	–	cnnvd
Cvelist	CVE-2022-0424 Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure	9 May 202216:50	–	cvelist
Nuclei	Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure	27 Jun 202603:01	–	nuclei
NVD	CVE-2022-0424	9 May 202217:15	–	nvd
Patchstack	WordPress Popup by Supsystic plugin <= 1.10.8 - Unauthenticated Subscriber Email Addresses Disclosure vulnerability	18 Apr 202200:00	–	patchstack
Prion	Authentication flaw	9 May 202217:15	–	prion
Positive Technologies	PT-2022-13173 · Supsystic · The Popup By Supsystic	9 May 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-0424	22 May 202522:16	–	redhatcve

NVD

Vulners

Node

supsystic popupRange<1.10.9wordpress

[
  {
    "product": "Popup by Supsystic",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.10.9",
        "status": "affected",
        "version": "1.10.9",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/1e4593fd-51e5-43ca-a244-9aaef3804b9f

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Unauthenticated AJAX action accessible via WordPress admin-ajax.php that discloses subscribed users' email addresses	CWE-306
page	request body	/wp-admin/admin-ajax.php	Unauthenticated AJAX action accessible via WordPress admin-ajax.php that discloses subscribed users' email addresses	CWE-306
reqType	request body	/wp-admin/admin-ajax.php	Unauthenticated AJAX action accessible via WordPress admin-ajax.php that discloses subscribed users' email addresses	CWE-306
search[text_like]	request body	/wp-admin/admin-ajax.php	Unauthenticated AJAX action accessible via WordPress admin-ajax.php that discloses subscribed users' email addresses	CWE-306
_search	request body	/wp-admin/admin-ajax.php	Unauthenticated AJAX action accessible via WordPress admin-ajax.php that discloses subscribed users' email addresses	CWE-306
pl	request body	/wp-admin/admin-ajax.php	Unauthenticated AJAX action accessible via WordPress admin-ajax.php that discloses subscribed users' email addresses	CWE-306
sidx	request body	/wp-admin/admin-ajax.php	Unauthenticated AJAX action accessible via WordPress admin-ajax.php that discloses subscribed users' email addresses	CWE-306
rows	request body	/wp-admin/admin-ajax.php	Unauthenticated AJAX action accessible via WordPress admin-ajax.php that discloses subscribed users' email addresses	CWE-306