EUVD-2026-70999
GHSA-669m-vjx9-jv4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with JetPopup ≤2.0.20.2
-
ExploitSend unauthenticated HTTP request to unprotected endpoint
-
ExecutionMissing authorization check skipped
-
ImpactRetrieve restricted popup/configuration data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of JetPopup installed on any WordPress site running version 2.0.20.2 or earlier. The CVSS vector (PR:N/AC:L/UI:N) confirms no authentication, no elevated complexity, and no user interaction are required. Exploitation is limited to read-only confidentiality impact (C:L); integrity and availability are unaffected. The affected functionality is specific to JetPopup's internal endpoints, so only sites with the plugin active are exposed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) reflects a straightforward network-reachable, no-auth-required flaw with limited confidentiality impact and no integrity or availability consequence. This is consistent with an endpoint that leaks restricted but non-critical data (e.g., popup configuration, internal IDs, or user-facing settings). No KEV listing and no POC availability were indicated, keeping real-world risk moderate. The EPSS score is not available in the provided data. The 'Authentication Bypass' tag is technically a mislabel - CWE-862 is broken access control (a logged-in or anonymous user skips an authorization check), not an authentication bypass (CWE-287/306). Overall priority is low-to-medium: the impact is limited to confidentiality leakage, no active exploitation is confirmed, and the attack requires no special conditions beyond network access. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request directly to the vulnerable JetPopup endpoint (AJAX action or REST route) without supplying authentication credentials, bypassing the absent authorization check. The endpoint returns restricted configuration data or internal resource details. No public exploit or proof-of-concept is known at time of analysis, but the low complexity makes manual exploitation straightforward once the specific endpoint is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Missing authorization checks in Crocoblock's JetPopup WordPress plugin (versions through 2.0.20.2) allow unauthenticated remote attackers to access functionality or data that should be restricted to authorized users. The flaw, classified as CWE-862 (Missing Authorization), enables exploitation of incorrectly configured access control levels, resulting in low-impact information disclosure with no integrity or availability consequence. No public exploit has been identified at time of analysis, and EPSS and KEV data were not provided.
RemediationAI
Update JetPopup to a version beyond 2.0.20.2 - the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jet-popup/vulnerability/wordpress-jetpopup-plugin-2-0-20-2-broken-access-control-vulnerability) should be consulted for the confirmed fixed release once published. No exact patched version number was provided in the available data. As a compensating control where immediate upgrade is not possible, administrators can restrict access to the affected AJAX or REST endpoints via a WAF rule or by disabling the JetPopup plugin until a patch is applied; disabling the plugin removes all popup functionality site-wide, which may affect user experience. Patchstack Firewall users may have a virtual patch available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetPopup (CPE: cpe:2.3:a:crocoblock:jetpopup:*:*:*:*:*:*:*:*) is a popup builder plugin for WordPress developed by Crocoblock, operating within the Elementor/Gutenberg ecosystem. CWE-862 (Missing Authorization) indicates that one or more AJAX handlers, REST API endpoints, or admin-facing actions in the plugin fail to verify whether the requesting user holds sufficient permissions before executing the action or returning data. This is a classic WordPress broken-access-control pattern where nonce verification may be present but capability checks (e.g., current_user_can()) are absent or insufficient, making the endpoint reachable by unauthenticated or low-privileged actors.
Know when Jetpopup gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated endpoint with no complexity or interaction; impact is read-only data leakage, no integrity or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects JetPopup: from n/a through 2.0.20.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB