Vulnerability · Published May 9, 2022 · Assigned by WPScan
CVE-2022-0424Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure
Medium 5.3
In plain English
A medium-severity missing authentication in Popup by Supsystic from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)2.8%top 13.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Popup by Supsystic | 1.10.9 – before 1.10.9 |
Weakness: CWE-306