CVE-2022-0479

Deeper analysis

The vulnerability is an SQL injection flaw in the Popup Builder WordPress plugin prior to version 4.1.1. It stems from a lack of sanitization and escaping on the sgpb-subscription-popup-id parameter when the value is incorporated into a SQL statement within the All Subscribers section of the administrative dashboard, and the same issue can be leveraged for reflected cross-site scripting.

An unauthenticated remote attacker can supply a malicious parameter value through a crafted request to the affected dashboard endpoint, enabling execution of arbitrary SQL queries that may result in data exfiltration, modification, or deletion. The reflected XSS vector allows the same payload to target a logged-in administrator who follows a malicious link, potentially leading to session hijacking or administrative account takeover.

The referenced WordPress plugin changeset and WPScan advisory document that the issue is resolved by updating to version 4.1.1 or later, which adds proper input sanitization and escaping for the parameter. The EPSS score has remained at its observed peak of 0.7637 since disclosure.