A missing authorization check in the WP Popups (wp-popups-lite) plugin for versions up to 2.2.0.5 allows an attacker to bypass the intended access controls and manipulate plugin configurations or content. The vulnerability arises from incorrectly configured security levels that do not enforce proper permission checks. Exploitation can lead to unauthorized modification of popup settings, injection of malicious content, or exposure of confidential content hosted by the plugin, compromising the integrity and confidentiality of the site.

The issue affects the Damian WP Popups wp-popups-lite plugin through any build up to and including version 2.2.0.5. Users running any of these versions on their WordPress installations are susceptible.

The CVSS score of 6.5 places the vulnerability in the medium‑to‑high severity range. The EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via the web interface, where an authenticated user with sufficient privileges—such as an account lacking proper role restrictions—could reach the plugin’s configuration pages and alter settings without further permissions. The absence of an explicit workaround suggests that the only viable mitigations revolve around applying a patch or disabling the plugin.