CVE-2022-29495

MEDIUMNuclei

WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-29495 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin settings.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 20, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Popup Builder (WordPress plugin)

Browse Sygnoos / Popup Builder (WordPress plugin)
CVE List<= 4.1.11 to ≤ 4.1.11affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery

Sygnoos Popup Builder plugin <= 4.1.11 for WordPress contains a cross-site request forgery caused by lack of CSRF protection in plugin settings update, letting attackers change settings without authorization, exploit requires victim to visit malicious site or click malicious link.

Impact

Attackers can modify plugin settings without authorization, potentially leading to site defacement or malicious content injection.

Remediation

Implement CSRF tokens and verify requests properly, update to the latest plugin version.

AuthorsShivam Kamboj
Template tagscvecve2022wordpresswp-pluginpopup-buildercsrfauthenticatedwp
https://nvd.nist.gov/vuln/detail/CVE-2022-29495 https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-11-cross-site-request-forgery-csrf-leading-to-plugin-settings-update

Source: ProjectDiscovery

References

3