CVE-2025-14895mediumCWE-862

CVE-2025-14895: fallo de gravedad media en roxnor Popup builder with Gamification…

PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.3%
The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete analytics data including device types, browser information, countries, referrer URLs, and campaign metrics.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Productos afectados
roxnor · Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
CVEs relacionadas — roxnor Popup builder with Gamification…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-13192HIGHPopup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API EndpointsEPSS 0.4%CVE-2025-10862HIGHPopup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'EPSS 0.4%CVE-2025-10861HIGHPopup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request ForgeryEPSS 0.4%CVE-2025-14441MEDIUMPopupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data DeletionEPSS 0.2%