CVE-2025-14441

Name of the Vulnerable Software and Affected Versions Popupkit plugin for WordPress versions through 2.2.0

Description The Popupkit plugin for WordPress has a flaw that allows authenticated attackers with Subscriber-level access or higher to delete arbitrary subscriber records. This is due to insufficient authorization checks on the DELETE /subscribers REST API endpoint. Specifically, the permission callback function only validates a WordPress nonce (wp rest nonce) without verifying user capabilities. This allows unauthorized data deletion via the affected API endpoint. The vulnerable parameter is not specified.

Recommendations Update the Popupkit plugin to a version beyond 2.2.0.