Popup Maker CVE-2026-85004

Exploitation requires a logged-in account with only minimal privileges (Subscriber level or above) on a Popup Maker ≤1.4.5 installation, plus a valid nonce for the account-connection action that WordPress exposes to authenticated users; the vulnerable code path verifies the nonce but performs no capability check. The practical limiting factors are that the attacker must be authenticated (so the site must permit user registration for an external attacker, otherwise an insider account is needed) and that impact is confined to overwriting the site-wide linked-service-account and API configuration option - there is no code execution, data disclosure, or availability impact. No administrator interaction is required.

This is a moderate, not critical, issue - the CVSS 3.1 base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects a network-exploitable but authentication-gated broken-access-control flaw (CWE-284) with only limited integrity impact and no confidentiality or availability loss. The PR:L metric confirms a low-privileged authenticated account (e.g., Subscriber) is required, which meaningfully constrains the attacker population to sites that allow self-registration or to insiders. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so there is no public exploit identified at time of analysis - the only intelligence sources are the WPScan advisory and the NVD/EUVD records. There is no SSVC decision data supplied. The signals are internally consistent (network vector with low-privilege authentication matches the 'Subscriber can overwrite admin-only option' description), so no metric conflicts are evident; the main caveat is that EPSS is simply absent rather than low, so exploitation probability cannot be quantified from this data. Net: a real but bounded defense-in-depth priority - patch in routine cycles, prioritize sooner on sites with open user registration.

An attacker registers or already holds a Subscriber-level account on a WordPress site running Popup Maker ≤1.4.5, obtains the valid nonce exposed to logged-in users, and submits the account-connection action, which only checks the nonce and not the user's capability. This lets the low-privileged user overwrite the site-wide linked-service-account and API configuration option that should be administrator-only, hijacking or disrupting the plugin's external service integration. No public exploit code was identified at time of analysis, but the attack requires only a standard authenticated request (AV:N/AC:L).