Popup Maker Wp
Monthly
Authenticated attackers holding only Subscriber-level WordPress credentials can abuse Popup Maker WP through 1.4.5 to store display-targeting values that the plugin later invokes as zero-argument PHP callables on public page loads, resulting in sensitive information disclosure and denial of service. The flaw stems from missing authorization checks on several of the plugin's actions and its management page, which the plugin exposes to any logged-in user; publicly available exploit code exists and the WPScan disclosure makes the attack path straightforward to reproduce. The main practical prerequisite is that the target site permits user self-registration or that the attacker already holds a low-privileged account, and because only zero-argument callables are invoked the impact stays below full remote code execution, consistent with the CVSS 5.4 Medium rating.
Authenticated attackers holding only Subscriber-level WordPress credentials can abuse Popup Maker WP through 1.4.5 to store display-targeting values that the plugin later invokes as zero-argument PHP callables on public page loads, resulting in sensitive information disclosure and denial of service. The flaw stems from missing authorization checks on several of the plugin's actions and its management page, which the plugin exposes to any logged-in user; publicly available exploit code exists and the WPScan disclosure makes the attack path straightforward to reproduce. The main practical prerequisite is that the target site permits user self-registration or that the attacker already holds a low-privileged account, and because only zero-argument callables are invoked the impact stays below full remote code execution, consistent with the CVSS 5.4 Medium rating.