Read the docs
TI-2022-02220 Aliases CVE-2022-2405GHSA-wmh8-mcwp-x84h

WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

Priority MEDIUM 53CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering, Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352 and CWE-862.

Summary

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter (Unknown): 1.2.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter1.2.9 to before 1.2.91.2.9Patch availableCNA
  • WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter VendorUnknown Affected 1.2.9 to before 1.2.9 Fixed in 1.2.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:themehunk:wp_popup_builder:*:*:*:*:*:wordpress:*:*before 1.2.9Vulnerablethemehunk
  • cpe:2.3:a:themehunk:wp_popup_builder:*:*:*:*:*:wordpress:*:* Versions before 1.2.9 Vulnerable ·themehunk

Remediation

  • Fix · CNA WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter (Unknown) Fixed in 1.2.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter 1.2.9

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2022-02219 WP Popup Builder < 1.2.9 - Reflected Cross-Site ScriptingPriority MEDIUM 60
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2405
  2. 2026-10-03 Alias added: GHSA-wmh8-mcwp-x84h

References

Exploit 1

  • TI-2024-08412 Code injection in themehunk WP Popup Builder – Popup Forms and Marketing Lead Generation CVSS 3.1CRITICAL 9.8
  • TI-2022-02219 WP Popup Builder < 1.2.9 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2025-39051 WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences