CVE-2025-14441

The CVE CVE-2025-14441 affects the Popupkit/Popup Builder WordPress plugin, where the DELETE /subscribers REST endpoint allows arbitrary subscriber data deletion due to a permission-one-check flaw: permission_callback validates only wp_rest nonce and not user capabilities. Exploitation is possibl...

CVE-2025-14441: Missing Authorization

The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE /subscribers REST API endpoint in all versions up to, and including, 2.2.0. This is due to the permissioncallback only validating wprest nonce without checking user...

WordPress Popupkit plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Subscriber Data Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin PopupKit versions = 2.2.0...