WordPress Plugin Vulnerabilities

Newsletter Popup <= 1.2 - List Deletion via CSRF

Description

The plugin does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack

Proof of Concept

Affects Plugins

Plugin icon
newsletter-popup
No known fix

References

CVE
CVE-2024-3643

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
698277e6-56f9-4688-9a84-c2fa3ea9f7dc

Timeline

Publicly Published
2024-04-25 (about 1 year ago)
Added
2024-04-25 (about 1 year ago)
Last Updated
2024-04-25 (about 1 year ago)

Other

Published
Title
Published
2022-01-24
Title
Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF
Published
2024-12-11
Title
WP Mailster < 1.8.18.0 - Cross-Site Request Forgery
Published
2022-10-31
Title
Content Egg < 5.5.0 - Multiple CSRF
Published
2024-04-05
Title
Ultimate Maps by Supsystic < 1.2.17 - Cross-Site Request Forgery
Published
2024-12-12
Title
MDC Comment Toolbar <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting