CVE-2022-44585: WordPress Homepage PopUp plugin <= 1.2.5 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Solution

No patched version is available. No reply from the vendor.

Mika discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Homepage Pop-up Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has not been known to be fixed yet.

1 other known vulnerability for this pluginTo plugin page

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more