CVE-2025-14446
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
2Description
The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotify_cp_reset() function in all versions up to, and including, 1.1.37. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset plugin settings to their default values.
Analysis
Popup Builder (Easy Notify Lite) plugin for WordPress versions up to 1.1.37 allows authenticated attackers with Subscriber-level access to reset plugin settings to default values due to missing capability checks in the easynotify_cp_reset() function. The vulnerability requires user authentication and does not grant elevated privileges or information disclosure, resulting in a CVSS score of 5.4 (medium severity). No public exploit code or active exploitation has been identified at time of analysis, though the issue poses moderate risk to WordPress installations relying on plugin configuration integrity.
Technical Context
The vulnerability stems from CWE-862 (Missing Authorization), a common WordPress plugin flaw where administrative functions fail to verify user capabilities before execution. The easynotify_cp_reset() function in the Easy Notify Lite plugin processes reset requests without calling wp_verify_nonce() or checking current_user_can() for admin-level capabilities. This allows any authenticated WordPress user-including those with minimal Subscriber role-to trigger the reset endpoint via AJAX or direct requests. The affected code is located in inc/functions/enoty-functions.php at line 304, as confirmed by both the tagged release (version 1.1.37) and trunk branches in the WordPress plugin repository.
Affected Products
WordPress plugin Popup Builder (Easy Notify Lite) versions 1.1.37 and earlier (CPE: wordpress_plugin/easy-notify-lite) are affected. The vulnerability exists across all versions up to and including the latest tagged release 1.1.37, as documented in the WordPress plugin repository trac browser. Organizations using any version of Easy Notify Lite should evaluate their current deployment version and initiate patching. Detailed vulnerability information is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/f67ab0cf-340d-4234-a857-1883f91c3ab6.
Remediation
Update the Easy Notify Lite plugin to version 1.1.38 or later, which includes capability checks in the easynotify_cp_reset() function to restrict reset functionality to users with admin-level permissions. WordPress administrators should navigate to Plugins > Installed Plugins in the WordPress dashboard, locate Popup Builder (Easy Notify Lite), and apply the update immediately. For sites with automatic plugin updates enabled, the patch will be deployed automatically. No workarounds are available short of deactivating the plugin. Verify the update by confirming the version in wp-content/plugins/easy-notify-lite/ and review plugin settings after patching to ensure no unintended resets occurred.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today