PT-2026-1412 · WordPress · Popupkit

Athiwat Tiprasaharn · Published 2026-01-06 · Updated 2026-01-06 · CVE-2025-14441

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Popupkit plugin for WordPress versions through 2.2.0

Description The Popupkit plugin for WordPress has a flaw that allows authenticated attackers with Subscriber-level access or higher to delete arbitrary subscriber records. This is due to insufficient authorization checks on the DELETE /subscribers REST API endpoint. Specifically, the permission callback function only validates a WordPress nonce (wp rest nonce) without verifying user capabilities. This allows unauthorized data deletion via the affected API endpoint. The vulnerable parameter is not specified.

Recommendations Update the Popupkit plugin to a version beyond 2.2.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14441

Affected Products

Popupkit

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-14441 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3421671%40popup-builder-block&new=3421671%40popup-builder-block&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.2.0/includes/Routes/Subscribers.php#L64 · Note
• https://t.me/cveNotify/147799 · Telegram Post
• https://twitter.com/CVEnew/status/2008408716219973710 · Twitter Post
• https://t.me/CVEtracker/41477 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/48f5a44d-d01f-4c41-98da-7c1f6c65c254?source=cve · Note
• https://plugins.trac.wordpress.org/browser/popup-builder-block/trunk/includes/Routes/Subscribers.php#L77 · Note
• https://twitter.com/VulmonFeeds/status/2008481750024904751 · Twitter Post
• https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.2.0/includes/Routes/Subscribers.php#L77 · Note