In Crocoblock JetPopup, an Authorization Bypass via User‑Controlled Key flaw allows attackers to manipulate internal identifiers and access or modify content that normally requires higher privileges. The vulnerability is categorized as an IDOR (CWE‑639). Without proper access control, a malicious actor can retrieve sensitive posts, pages, or pop‑up configurations, or change them, leading to data exposure or site defacement.

All installations of the JetPopup plugin that run version 2.0.20.1 or earlier are vulnerable. The affected vendor is Crocoblock and the product is JetPopup. If a site is running a newer release (above 2.0.20.1) the issue does not apply.

The CVSS v3.1 base score of 4.3 is moderate, indicating that the weakness can be leveraged when the correct identifiers are supplied. The EPSS score of less than 1% suggests a low probability of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires an attacker with some level of access to the WordPress administrative interface or the ability to guess valid resource identifiers.