Unauthorized Data Modification Vulnerability in Popup Builder by WordPress

CVE-2025-14446

What is CVE-2025-14446?

The Popup Builder (Easy Notify Lite) plugin for WordPress contains a security flaw that allows authenticated attackers with Subscriber-level access or higher to tamper with its settings. This is due to a lack of a capability check in the easynotify_cp_reset() function, which allows for unauthorized resetting of plugin configurations to default values. This vulnerability threatens the integrity of user data and the intended functionality of the plugin, making it imperative for users to review their security measures.

References