CVE-2022-0214 Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service
Unauthenticated attackers can cause a denial of service by sending unvalidated data to the Custom Popup Builder plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0214?
CVE-2022-0214 is a high-severity denial of service vulnerability in Unknown Popup | Custom Popup Builder, published on 14 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
Weakness: CWE-1284
Which versions are affected by CVE-2022-0214?
It affects 1 product.
Products include Custom Popup Builder Project Custom Popup Builder.
How do I fix CVE-2022-0214?
No fix has been published for CVE-2022-0214 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-0214 being exploited?
There is no known exploitation of CVE-2022-0214 in the wild and no public exploit code.
Other vulnerabilities in Unknown Popup | Custom Popup Builder
Sources
Also known as GHSA-7cgg-8926-325v.