CVE-2026-85005

Name of the Vulnerable Software and Affected Versions Popup Maker WP WordPress plugin versions prior to 1.4.6

Description The plugin fails to perform authorization checks on several actions and exposes its management page to any logged-in user. This allows users with low-privileged roles, such as Subscriber, to store display-targeting values. These values are subsequently invoked as zero-argument PHP callables—functions that can be called without passing any arguments—during public page loads, which can result in sensitive information disclosure and denial of service.

Recommendations Update the plugin to version 1.4.6 or later.