CVE-2022-2405

🗓️ 26 Sep 2022 12:35:34Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 55 Views🌐 WEB

The WP Popup Builder WordPress plugin before 1.2.9 allows authenticated users to delete arbitrary Popup

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-2405	21 May 202519:42	–	circl
CNNVD	WordPress plugin WP Popup Builder 安全漏洞	26 Sep 202200:00	–	cnnvd
CNVD	WordPress WP Popup Builder License Issue Vulnerability	28 Sep 202200:00	–	cnvd
Cvelist	CVE-2022-2405 WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion	26 Sep 202212:35	–	cvelist
EUVD	EUVD-2022-34668	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2405	26 Sep 202213:15	–	nvd
Patchstack	WordPress WP Popup Builder plugin <= 1.2.9 - Authenticated Arbitrary Popup Deletion vulnerability	5 Sep 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	26 Sep 202213:15	–	prion
Positive Technologies	PT-2022-16434 · WordPress · Popup Builder	26 Sep 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-2405	23 May 202501:07	–	redhatcve

NVD

Vulners

Node

themehunk wp_popup_builderRange<1.2.9wordpress

[
  {
    "product": "WP Popup Builder – Popup Forms , Marketing PoPuP &  Newsletter",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.2.9",
        "status": "affected",
        "version": "1.2.9",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/50037028-2790-47ee-aae1-faf0724eb917

Parameter	Position	Path	Description	CWE
bid	request body	wordpress/wp-admin/admin-ajax.php?action=delete_popup	AJAX action delete_popup lacks authorization/CSRF protection.	CWE-352, CWE-862

21 May 2025 20:15Current

4.5Medium risk

Vulners AI Score4.5

CVSS 3.14.3

EPSS0.00076

SSVC

cve-2022-2405 wp popup builder wordpress plugin authorization csrf ajax security vulnerability