Unauthorized Data Modification Vulnerability in The Popup Box Plugin

CVE-2024-10861

5.3MEDIUM

Key Information

Vendor: Ays-pro
Status: Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
Vendor: CVE Published:; 16 November 2024

Summary

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data.

Affected Version(s)

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 4.9.7

CVSS V3.1

Score:

5.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Nov 16, 2024
Disclosed
Nov 15, 2024

Collectors

NVD DatabaseMitre Database

Credit

Trương Hữu Phúc (truonghuuphuc)