The Popover Windows WordPress plugin contains a missing capability check on multiple AJAX actions such as pop_submit and poptheme_submit. This omission represents a CWE‑862 – missing authorization weakness, enabling authenticated users with subscriber-level access or higher to modify the plugin’s settings and content through Ajax. The result is unauthorized configuration changes that can alter how pop‑over windows display and behave on the site.

The affected product is the Popover Windows plugin from melodicmedia, all releases up to and including version 1.2. WordPress sites hosting any of these versions are vulnerable. No specific CPE string is available in the data.

The CVSS score of 4.3 indicates a moderate risk, and the EPSS score of less than 1% suggests a very low probability of exploitation. Because the flaw requires authenticated access, an attacker must be logged in as a subscriber or higher; there is no remote code execution. The vulnerability is not listed in the CISA KEV catalog, implying it has not been publicly exploited at scale. The author of the plugin should prioritize fixing the missing capability checks, and site owners should apply the fix once available.