What’s Vulnerable › Vulnerabilities

CVE-2022-2405: WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-26 · updated 2026-06-17
• Weakness: CWE-352

Description

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

Affected products

• WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter: before 1.2.9 — fixed in 1.2.9

How to fix

Upgrade to a fixed version: WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter 1.2.9. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/50037028-2790-47ee-aae1-faf0724eb917
• https://wpscan.com/vulnerability/50037028-2790-47ee-aae1-faf0724eb917

Get alerted when CVE-2022-2405 or the next vulnerability affects your stack