5.3

CVE-2022-0424

Exploit

Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure

Popup by Supsystic <= 1.10.8 - Sensitive Information Disclosure

The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
Mögliche Gegenmaßnahme
Smart Popup by Supsystic: Update to version 1.10.9, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Supsystic ≫ Popup SwPlatformwordpress Version < 1.10.9
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Smart Popup by Supsystic
Version [*, 1.10.9)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.69% 0.839
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://wpscan.com/vulnerability/1e4593fd-51e5-43ca-a244-9aaef3804b9f
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b3279b-fd39-4c34-92e8-57d309f37a93
Third Party Advisory