Arbitrary Data Deletion Vulnerability in Popupkit Plugin for WordPress

CVE-2025-14441

What is CVE-2025-14441?

The Popupkit plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access to delete arbitrary subscriber data. This issue arises from a lack of proper authorization checks on the DELETE /subscribers REST API endpoint, where the existing permission_callback only verifies the wp_rest nonce without properly validating user capabilities. As a result, any authenticated user can exploit this weakness to remove subscriber records, thereby jeopardizing the integrity and security of user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References