CVE-2026-85004 in Popup Maker Plugin
Summary
by MITRE • 10/02/2026
The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option (the linked service account and API configuration) that should only be modifiable by administrators.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in the Popup Maker WordPress plugin versions up to 1.4.5 represents a critical failure in access control mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw arises from an insufficient verification of user permissions during account connection operations within the plugin's administrative interface. While the implementation correctly utilizes nonces for cross-site request forgery protection, it neglects to validate whether the authenticated user possesses the necessary capabilities to modify sensitive configuration settings. In the WordPress ecosystem, capability checks are essential to ensure that only users with elevated privileges, such as Administrators, can alter site-wide configurations. The absence of this check allows any logged-in user, regardless of their role or privilege level, including those assigned the lowest tier like Subscribers, to execute administrative actions intended for higher-privileged accounts.
From a technical perspective, the operational impact of this vulnerability is severe due to its potential for unauthorized configuration manipulation. An attacker with minimal privileges can overwrite critical plugin options that define linked service account credentials and API configurations. These settings typically control how the plugin interacts with external services, such as email marketing platforms or payment gateways. By modifying these parameters, an attacker can redirect data flows, intercept sensitive information transmitted to third-party services, or disrupt legitimate business operations by invalidating existing integrations. This capability effectively grants low-privileged users administrative-level access over specific functional components of the website, bypassing the intended security boundaries established by the site administrator.
This vulnerability aligns with several tactics and techniques within the MITRE ATT&CK framework for enterprise environments, particularly those related to persistence and privilege escalation through application misconfiguration. Although WordPress is a web application platform, the principles apply directly to how attackers exploit weak access controls to maintain footholds or escalate privileges. The specific technique resembles unauthorized API modification where an attacker alters system parameters to gain control over external integrations. This can lead to broader security compromises if the linked services contain sensitive customer data or financial information, as the attacker could potentially exfiltrate this data through manipulated webhooks or misconfigured endpoints.
Mitigation strategies for this vulnerability involve immediate updates and rigorous access control audits. The primary remediation is to upgrade the Popup Maker plugin to a version that includes proper capability checks on all administrative actions. Site administrators should also review user roles and capabilities, ensuring that only trusted individuals have access to areas where sensitive integrations are managed. Additionally, implementing strict input validation and enforcing server-side permission verification for every state-changing request is crucial. Security monitoring tools can be configured to alert on unusual changes to plugin options by low-privileged users, providing an additional layer of defense against exploitation attempts until the software patch is applied.