The Nelio Popups plugin for WordPress contains a missing authorization flaw (CWE-862). Incorrectly configured access control security levels enable the plugin to grant users with insufficient privileges full access to popup configuration and management functions. This flaw allows an attacker who can authenticate as a low‑privilege user or obtain a session cookie to modify, delete, or create popups without proper authorization.

Affected systems include WordPress sites running Nelio Software Nelio Popups plugin versions 1.3.5 or earlier. The vulnerability applies across all those releases, from the earliest advertised version through 1.3.5. Site owners using these versions of the plugin should verify their installed version number and determine whether an update is available.

The CVSS score for this issue is 4.3, which corresponds to a low impact level. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. The flaw can be exploited remotely by users who can gain a WordPress login session; however, the exact attack steps and whether outside users can trigger the exploitation are inferred from the description rather than directly stated. Nonetheless, should exploitation occur, the attacker could create or alter popups, potentially leading to defacement or phishing attacks. Administrators should treat this as low risk but apply mitigation promptly.