CVE-2022-2405

CVE-2022-2405: WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

Vendor Unknown

Product WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter

Weakness CWE-862 · Missing authorization

Published September 26, 2022

Last update May 21, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

Key dates

02Disclosure timeline

September 26, 2022 CVE published

May 21, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2405 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2025-23999 WordPress Breeze plugin <= 2.2.13 - Broken Access Control vulnerability CVE-2025-49394 WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability CVE-2025-66105 WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.8 - Broken Access Control vulnerability CVE-2023-37989 WordPress Easyship WooCommerce Shipping Rates plugin <= 0.9.0 - Broken Access Control vulnerability CVE-2020-36902 UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges