Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More, CVE-2026-85005
- CVE, Research URL
- Home page URL
- Application
-
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More
- Published on
- Oct 02, 2026
- Research Description
- The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.
- Affected versions
-
max 1.4.5.
- Status
-
vulnerable