CVE-2022-38077: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in WP OnlineSupport's Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin versions 2.2.1 and below. The vulnerability was assigned CVE-2022-38077 and was publicly disclosed on March 29, 2023 (NVD).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The plugin lacks CSRF protection mechanisms when resetting its Popup settings, which could allow attackers to make a logged-in administrator reset settings via a CSRF attack. The vulnerability received a CVSS v3.1 base score of 8.8 (HIGH) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, while Patchstack assessed it with a CVSS score of 4.3 (MEDIUM) (Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication, specifically resetting the plugin's Popup settings (WPScan).

The vulnerability has been fixed in version 2.2.2 of the plugin. Users are advised to update to version 2.2.2 or later to remove the vulnerability (Patchstack).