CVE-2025-14441mediumCWE-862

CVE-2025-14441: fallo de gravedad media en roxnor Popup builder with Gamification…

Popupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.2%
The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribers` REST API endpoint in all versions up to, and including, 2.2.0. This is due to the `permission_callback` only validating wp_rest nonce without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary subscriber records.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
roxnor · Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
CVEs relacionadas — roxnor Popup builder with Gamification…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-13192HIGHPopup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API EndpointsEPSS 0.4%CVE-2025-10862HIGHPopup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'EPSS 0.4%CVE-2025-10861HIGHPopup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request ForgeryEPSS 0.4%CVE-2025-14895MEDIUMPopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data DeletionEPSS 0.3%