CVE-2022-4124

2022-12-1914:15:12

CWE-352

CWE-862

[email protected]

web.nvd.nist.gov

cve-2022-4124

popup manager

wordpress plugin

authorization

csrf

unauthenticated users

deletion

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them

Affected configurations

Vulners

NVD

Node

popup_manager_projectpopup_managerRange≤1.6.6

VendorProductVersionCPE
popup_manager_projectpopup_manager*cpe:2.3:a:popup_manager_project:popup_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
popup_manager_project	popup_manager	*	cpe:2.3:a:popup_manager_project:popup_manager::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Popup Manager",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "1.6.6"
      }
    ],
    "defaultStatus": "affected"
  }
]