Authorization Bypass in PopupKit Plugin for WordPress

CVE-2025-14895

What is CVE-2025-14895?

The PopupKit plugin for WordPress suffers from an authorization bypass flaw which affects all versions up to 2.2.0. The vulnerability arises because the plugin fails to correctly verify user permissions for accessing the /popup/logs REST API endpoint. This allows authenticated attackers, including those with merely Subscriber-level access, to gain unauthorized access to sensitive analytics data, such as device types, browser information, geographic location, referrer URLs, and campaign performance metrics. It is crucial for users to implement the latest security updates to mitigate this risk.

References