CVE-2022-32289 - WordPress Popup Builder plugin <= 4.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change

MEDIUM

WordPress Popup Builder plugin <= 4.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change

Published Jul 21, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.32%

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
<= 4.1.0	affected	<=4.1.0

Vendor solution

Update to 4.1.1 or higher version.

Weaknesses (1)

CWE-352

CSRF

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-53482		Advisory
https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-0-cross-site-request-forgery-csrf-vulnerability-leading-to-popup-status-change		x_refsource_CONFIRMPatchThird Party Advisory
https://wordpress.org/plugins/popup-builder/#developers		x_refsource_CONFIRMRelease NotesThird Party Advisory