Sygnoos Popup Builder plugin <= 4.1.11 for WordPress contains a cross-site request forgery caused by lack of CSRF protection in plugin settings update, letting attackers change settings without authorization, exploit requires victim to visit malicious site or click malicious link. [已公开] id: CVE-2022-29495 info: name: WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery author: Shivam Kamboj severity: medium description: | Sygnoos Popup Builder plugin <= 4.1.11 for WordPress contains a cross-site request forgery caused by lack of CSRF protection in plugin settings update, letting attackers change settings without authorization, exploit requires victim to visit malicious site or click malicious link. impact: | Attackers can modify plugin settings without authorization, potentially leading to site defacement or malicious content injection. remediation: | Implement CSRF tokens and verify requests properly, update to the latest plugin version. reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-29495 - https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-11-cross-site-request-forgery-csrf-leading-to-plugin-settings-update metadata:

未知

POC: 已公开