PT-2022-19619 · Wow Company · Popup Box

0Xb9 + 1 · Published 2022-05-18 · Updated 2022-05-26 · CVE-2022-29445

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wow-Company's Popup Box plugin versions <= 2.1.2

Description The issue is related to an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with administrator or higher role privileges can potentially include and execute local files on the server. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For Wow-Company's Popup Box plugin versions <= 2.1.2, update to a version higher than 2.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for users with administrator or higher roles until a patch is available.

Fix

Weakness Enumeration

CWE-706

Related Identifiers

CVE-2022-29445

Affected Products

Popup Box

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-29445 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29445 · Vendor Advisory
• https://wordpress.org/plugins/popup-box/#developers · Vendor Advisory
• https://t.me/cibsecurity/42944 · Telegram Post
• https://patchstack.com/database/vulnerability/popup-box/wordpress-popup-box-plugin-2-1-2-authenticated-local-file-inclusion-lfi-vulnerability · Note