CVE-2025-14441: Popupkit WordPress Auth Bypass Flaw

CVE-2025-14441 Overview

The Popupkit plugin for WordPress contains an authorization bypass vulnerability in its REST API endpoint that allows authenticated attackers to delete arbitrary subscriber data. The vulnerability exists in versions up to and including 2.2.0, where the DELETE /subscribers REST API endpoint fails to properly validate user capabilities before processing deletion requests.

The root of this security flaw lies in the permission_callback function, which only validates the WordPress REST nonce without checking whether the requesting user has the appropriate capabilities to perform subscriber deletion operations. This missing authorization check enables any authenticated user with Subscriber-level access or above to exploit this vulnerability.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can delete arbitrary subscriber records from WordPress sites using the Popupkit plugin, potentially causing significant data loss and business disruption.

Affected Products

• Popupkit (popup-builder-block) plugin for WordPress versions up to and including 2.2.0

Discovery Timeline

• January 6, 2026 - CVE-2025-14441 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-14441

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization). The Popupkit plugin registers a REST API endpoint for managing subscriber data, specifically the DELETE operation on the /subscribers route. When processing deletion requests, the endpoint's permission callback function performs nonce validation to prevent CSRF attacks but critically omits capability checks that would verify the user has administrative permissions to delete subscriber records.

In WordPress, proper REST API authorization typically requires both nonce validation (to prevent CSRF) and capability checks (to enforce role-based access control). The vulnerable code path validates only the former, allowing any authenticated user who possesses a valid REST nonce to perform subscriber deletions regardless of their actual role within the WordPress installation.

Root Cause

The vulnerability stems from an incomplete implementation of the permission_callback function in the Subscribers REST API route handler. The callback function uses wp_verify_nonce() to validate the REST API nonce but does not include a corresponding current_user_can() check to verify that the authenticated user has appropriate capabilities such as manage_options or a custom capability for subscriber management. This architectural oversight allows privilege escalation where low-privileged users can perform administrative actions.

Attack Vector

An attacker exploiting this vulnerability requires:

1. Authenticated Access: A valid WordPress account with at least Subscriber-level privileges
2. Valid REST Nonce: Obtained through normal WordPress REST API interaction
3. Knowledge of Target Endpoint: The DELETE /subscribers endpoint path

The attack is network-accessible and requires no user interaction. An attacker can craft malicious DELETE requests to the vulnerable endpoint, specifying subscriber record IDs for deletion. Since no capability check is performed, the WordPress backend processes the deletion request as if it came from an authorized administrator.

The vulnerable code can be examined in the WordPress Popup Builder Code where the permission callback implementation is defined, and the route registration shows the DELETE endpoint configuration.

Detection Methods for CVE-2025-14441

Indicators of Compromise

• Unexpected DELETE requests to the WordPress REST API /subscribers endpoint from non-administrative users
• Audit log entries showing subscriber record deletions performed by users with Subscriber or Contributor roles
• Sudden unexplained decrease in subscriber count within the Popupkit plugin database tables
• REST API access logs showing repeated DELETE operations from low-privileged authenticated sessions

Detection Strategies

• Monitor WordPress REST API access logs for DELETE requests to the /wp-json/*/subscribers endpoint pattern
• Implement Web Application Firewall (WAF) rules to alert on subscriber deletion attempts from non-administrative user sessions
• Review WordPress user activity logs for privilege escalation indicators, specifically data modification actions by low-privileged accounts
• Configure SIEM rules to correlate REST API DELETE operations with user role metadata

Monitoring Recommendations

• Enable detailed WordPress REST API logging to capture endpoint access, HTTP methods, and authenticated user information
• Implement database audit logging on the Popupkit subscriber tables to track record deletions with associated user context
• Set up automated alerts for bulk deletion operations or unusual deletion patterns outside normal administrative activity windows
• Monitor for reconnaissance activity such as repeated enumeration of subscriber record IDs

How to Mitigate CVE-2025-14441

Immediate Actions Required

• Update the Popupkit (popup-builder-block) plugin to the latest patched version immediately
• Review subscriber data backups and verify data integrity to assess potential past exploitation
• Audit WordPress user accounts to identify any unauthorized Subscriber-level accounts that may have been created for exploitation
• Temporarily disable the Popupkit plugin if an update is not immediately available and the functionality is not critical

Patch Information

The vulnerability has been addressed in versions after 2.2.0. The fix implements proper capability checks within the REST API permission callback. Review the WordPress Popup Builder Changeset for details on the security patch implementation. The patched code can be viewed in the updated Subscribers.php.

Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Implement a custom mu-plugin to intercept and block DELETE requests to the vulnerable endpoint until patching is possible
• Use a WordPress security plugin or WAF to restrict REST API endpoint access based on user capabilities
• Temporarily revoke Subscriber-level account registrations and disable public registration if the attack surface cannot be otherwise reduced
• Apply network-level access controls to limit WordPress REST API access to trusted IP ranges for administrative functions

# Example .htaccess rule to restrict DELETE requests to subscribers endpoint
# Add to WordPress root .htaccess as temporary mitigation
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} DELETE
RewriteCond %{REQUEST_URI} ^.*\/subscribers.*$ [NC]
RewriteRule .* - [F,L]
</IfModule>