Arbitrary Data Deletion Vulnerability in Popupkit Plugin for WordPress
CVE-2025-14441
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 January 2026
What is CVE-2025-14441?
The Popupkit plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access to delete arbitrary subscriber data. This issue arises from a lack of proper authorization checks on the DELETE /subscribers REST API endpoint, where the existing permission_callback only verifies the wp_rest nonce without properly validating user capabilities. As a result, any authenticated user can exploit this weakness to remove subscriber records, thereby jeopardizing the integrity and security of user data.
Affected Version(s)
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers 0 <= 2.2.0