Popup Builder for WordPress has a flaw where unsubscribe tokens are generated deterministically. An unauthenticated attacker can guess a token if the victim’s email address is known and use it to remove an arbitrary subscriber from a mailing list. This bypasses the plugin’s authorization checks and results in data modification (unsubscribing a user) without valid credentials. The weakness is classified as CWE‑1241, an improper authorization issue.

The vulnerability affects all versions of the Popup Builder – Create highly converting, mobile friendly marketing popups. plugin up to and including 4.4.2, which is installed on WordPress sites that have not yet upgraded beyond that release.

The CVSS score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% suggests the chance of exploitation is low. The flaw is not currently listed in the CISA KEV catalog. Because the token is predictable and the attack requires only a known email address, an unauthenticated attacker can perform the removal by sending a simple HTTP request to the unsubscribe endpoint, possibly using brute force enumeration of the token space. The attack would be feasible if the endpoint is publicly accessible, but the overall likelihood remains low given the limited token space and the need for victim email knowledge.