Unauthorized Access Flaw in WowOptin Popup Plugin for WordPress
CVE-2026-14603
Currently unrated
What is CVE-2026-14603?
The WowOptin: Next-Gen Popup Maker plugin for WordPress, prior to version 1.4.38, is vulnerable due to insufficient authorization checks on a REST endpoint. This flaw allows unauthenticated users to disable all opt-in forms across the site and to inject new template-based opt-in entries into the database. Without proper safeguards, this vulnerability can compromise the integrity of user data and the functionality of opt-in mechanisms.
Affected Version(s)
WowOptin: Next-Gen Popup Maker 0 < 1.4.38
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.