CVE-2024-3643 Newsletter Popup <= 1.2 - List Deletion via CSRF

2024-05-1606:00:02

WPScan

github.com

wordpress

plugin

csrf

vulnerability

attackers

admins

AI Score

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:newsletter_popup_project:newsletter_popup:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "newsletter_popup_project",
    "product": "newsletter_popup",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "1.2"
      }
    ],
    "defaultStatus": "affected"
  }
]