Medium severity · published Feb 10, 2026
CVE-2025-14895
PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete analytics data including device types, browser information, countries, referrer URLs, and campaign metrics.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers · roxnor
through 2.2.0 · source: vendor
Affected product
PB
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
roxnor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14895
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14895
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.2.0/includes/Routes/Popup.php#L145
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.2.0/includes/Routes/Popup.php#L32
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.2.0/includes/Routes/Popup.php#L85
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3421671/popup-builder-block/trunk/includes/Routes/Popup.php
research.cleantalk.org
https://research.cleantalk.org/cve-2025-14895
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/c13bb699-f065-4065-9ea5-bb86d24e09ab?source=cve
More from Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
8.2
CVE-2025-13192
Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints
7.5
CVE-2025-10861
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery
7.5
CVE-2025-10862
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'
4.3
CVE-2025-14441
Popupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion