PT-2026-104086

CVE-2026-85004

Published

2026-10-02

Updated

2026-10-09

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Popup Maker WordPress plugin versions prior to 1.4.6

Description The plugin fails to perform a capability check on an account-connection action, relying solely on nonce verification. This allows authenticated users with minimal privileges, such as Subscribers, to overwrite site-wide configuration options, including the linked service account and API configuration, which should be restricted to administrators.

Recommendations Update the plugin to version 1.4.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Artus Kg

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers