The Popup Builder plugin for WordPress contains a missing authorization check on the DELETE `/subscribers` REST API endpoint. The endpoint accepts a wp_rest nonce but does not verify that the authenticated user has sufficient capabilities. As a result, any authenticated user with Subscriber-level access or higher can delete arbitrary subscriber records. This allows attackers to remove subscriber data, potentially causing loss of contact information and disrupting marketing or communication functionality. The weak point is the lack of capability verification, which is a typical Missing Authorization weakness (CWE‑862).

The issue affects the Popup Builder plugin from roxnor, specifically all released versions up to and including 2.2.0. Users running any of these versions on a WordPress site are vulnerable. The vulnerability is present on the REST API route responsible for subscriber deletion.

The CVSS score of 4.3 indicates moderate impact. The EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be authenticated with at least Subscriber privilege to exploit the flaw. Because the endpoint relies only on a nonce, privileged users can make a DELETE request and wipe subscriber records without further authorization checks. The practical risk is data loss for sites using the plugin, but the lack of wide exploitation potential and low EPSS score make it a moderate priority.