Popup Maker for WordPress up to version 1.4.5 contains a missing authorization check on its sgpm_connect account‑connection action. The plugin validates only a nonce and does not verify the user's capability. Because of this oversight, any authenticated user with minimal privileges—such as a Subscriber—can overwrite the site‑wide options that store the linked service account and API configuration. Changing these settings can alter or disable core plugin functionality and potentially allow further exploitation if those configurations are leveraged by attackers.

The flaw affects WordPress sites that have the Popup Maker plugin installed at any version up through 1.4.5 inclusive. The CNA data references the plugin as Unknown:Popup Maker, and no additional version granularity is specified beyond the 1.4.5 cutoff.

The CVSS score of 4.3 indicates moderate risk, and the EPSS score of less than 1% suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker is authenticated as a user with a minimal privilege role, such as a Subscriber, and that they can trigger the sgpm_connect endpoint. The attack vector is internal; no external network access is required. By modifying the plugin configuration, an attacker can alter or disable core plugin features, which could lead to unintended pop‑up behavior or other configuration changes, but the overall impact remains limited to the plugin scope.