CVE-2024-3643

CWE-352 — Cross-Site Request Forgery (CSRF)CWE-995 documents5 sources
Severity
8.8HIGH
EPSS
0.3%
top 43.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Newsletter PopupMndpsingh287 Newsletter Popup
Timeline
PublishedMay 16

Description

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-hc4m-mm2c-rjg7: The Newsletter Popup WordPress plugin through 1↗2024-05-16
▶
CVEList
Newsletter Popup <= 1.2 - List Deletion via CSRF↗2024-05-16
▶

💥Exploits & PoCs

1
Nuclei
Netis Wifi Router - Information Disclosure
▶