Unauthorized Data Modification in Popover Windows Plugin for WordPress

CVE-2025-14395

What is CVE-2025-14395?

The Popover Windows plugin for WordPress is affected by a vulnerability that allows authenticated attackers to modify data due to missing capability checks in multiple AJAX actions such as pop_submit and poptheme_submit. This issue affects all versions up to and including version 1.2, enabling users with subscriber-level access and above to change plugin settings and content without proper authorization, posing a significant risk to the integrity of the data managed by the plugin.

References