CVE-2025-14895: PopupKit WordPress Auth Bypass Flaw

CVE-2025-14895 Overview

The PopupKit plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 2.2.0. The vulnerability exists due to improper verification of user authorization when accessing the /popup/logs REST API endpoint. This security flaw allows authenticated attackers with Subscriber-level access or above to read and delete analytics data, including device types, browser information, countries, referrer URLs, and campaign metrics.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can access and manipulate sensitive analytics data through the unprotected REST API endpoint, potentially exposing visitor tracking information and campaign performance metrics.

Affected Products

• PopupKit WordPress Plugin versions up to and including 2.2.0
• WordPress sites using the vulnerable PopupKit plugin with authenticated user access
• Sites allowing Subscriber-level user registrations

Discovery Timeline

• 2026-02-10 - CVE-2025-14895 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-14895

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a fundamental access control flaw where the application fails to perform authorization checks before granting access to protected resources. The PopupKit plugin exposes a REST API endpoint at /popup/logs that handles analytics data operations without properly validating whether the requesting user has the appropriate permissions to perform such actions.

The vulnerability is network-accessible, meaning attackers can exploit it remotely over HTTP/HTTPS connections. The attack complexity is low, requiring only valid authentication credentials for a low-privileged user account such as a Subscriber. No user interaction is required for exploitation, making this vulnerability particularly concerning for WordPress installations that allow open user registration.

The impact primarily affects confidentiality and integrity of the analytics data. Attackers can read sensitive visitor analytics including device fingerprinting data, browser information, geographic location data, referrer URLs that may expose internal links or campaign sources, and campaign performance metrics. Additionally, attackers can delete this analytics data, potentially disrupting marketing campaigns and removing valuable business intelligence.

Root Cause

The root cause of this vulnerability lies in the missing permission callback or inadequate capability checks in the REST API route registration within the Popup.php file. When registering WordPress REST API endpoints, developers must implement proper permission_callback functions that verify the current user has the required capabilities. In this case, the plugin either omitted the permission callback entirely or implemented checks that were insufficient for protecting sensitive analytics operations.

The vulnerable code can be examined in the WordPress Popup Builder Code Snippet where the REST route registration occurs. Additional context is available at line 32 and line 85 of the same file.

Attack Vector

The attack leverages the WordPress REST API infrastructure to access the unprotected /popup/logs endpoint. An attacker would first need to obtain valid credentials for a low-privileged account on the target WordPress site. This could be accomplished through:

1. Registering a new user account on sites with open registration enabled
2. Compromising an existing Subscriber-level account
3. Using credentials obtained through other means such as credential stuffing

Once authenticated, the attacker can send crafted HTTP requests to the vulnerable REST API endpoint. The WordPress REST API uses cookie authentication for logged-in users, so requests can be made directly from the browser or via tools like cURL with appropriate session cookies. The endpoint responds with analytics data or accepts deletion requests without verifying the user's actual authorization level, treating any authenticated request as legitimate.

Detection Methods for CVE-2025-14895

Indicators of Compromise

• Unusual access patterns to WordPress REST API endpoints matching /wp-json/*/popup/logs from low-privileged user sessions
• Subscriber-level accounts making repeated requests to analytics-related API endpoints
• Unexpected deletions or gaps in popup analytics data
• Web server logs showing REST API requests to popup/logs endpoints with authenticated sessions

Detection Strategies

• Monitor WordPress REST API access logs for requests to /popup/logs endpoints from users with Subscriber, Contributor, or Author roles
• Implement web application firewall (WAF) rules to alert on REST API access patterns that deviate from expected administrative usage
• Review user activity logs for any Subscriber-level accounts accessing plugin-specific REST endpoints
• Deploy endpoint detection and response (EDR) solutions capable of monitoring WordPress plugin API interactions

Monitoring Recommendations

• Enable comprehensive logging for WordPress REST API requests including user role information
• Configure alerts for analytics data access or deletion operations performed by non-administrative users
• Implement baseline monitoring for normal API access patterns to identify anomalous behavior
• Regularly audit user accounts and their associated activity, particularly for sites with open registration

How to Mitigate CVE-2025-14895

Immediate Actions Required

• Update the PopupKit plugin to a version newer than 2.2.0 that includes the security patch
• Review web server logs for any suspicious access to the /popup/logs REST API endpoint
• Audit Subscriber-level user accounts for any unexpected activity
• Consider temporarily disabling the PopupKit plugin if an update is not immediately available

Patch Information

The vulnerability has been addressed in the plugin update. The security fix can be reviewed in the WordPress Popup Builder Changeset. Additional analysis is available from the Wordfence CVE Vulnerability Report and CleanTalk CVE-2025-14895 Analysis.

Workarounds

• Disable user registration on WordPress sites where it is not required
• Implement additional access controls at the web server level to restrict REST API access to administrative IP addresses
• Use a WordPress security plugin to add additional REST API protection layers
• Temporarily deactivate the PopupKit plugin until the update can be applied

# Restrict REST API access via .htaccess (Apache)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/.*popup/logs [NC]
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.100$
RewriteRule ^(.*)$ - [F,L]
</IfModule>