CVE-2024-3642 — Cross-Site Request Forgery in Newsletter Popup

CWE-352 — Cross-Site Request ForgeryCWE-476 — NULL Pointer Dereference4 documents4 sources
Severity
6.9MEDIUMNVD
EPSS
0.2%
top 56.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mndpsingh287 Newsletter Popup
Timeline
PublishedMay 16

Description

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:NExploitability: 1.7 | Impact: 4.7

Affected Packages1 packages

🔴Vulnerability Details

2
CVEList
Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF↗2024-05-16
▶
GHSA
GHSA-g8vg-m5vq-4hcq: The Newsletter Popup WordPress plugin through 1↗2024-05-16
▶
CVE-2024-3642 — Cross-Site Request Forgery | cvebase