CVE-2025-14395: 
WordPress vulnerability analysis and mitigation

CVE-2025-14395 is a Missing Authorization vulnerability in the Popover Windows plugin for WordPress, affecting all versions up to and including 1.2. Due to missing capability checks on multiple AJAX actions (e.g., pop_submit, poptheme_submit), authenticated attackers with subscriber-level access or above can modify the plugin's settings and content without proper authorization. The vulnerability was published on December 13, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization): the plugin's AJAX action handlers (pop_submit, poptheme_submit) do not perform capability checks before processing requests, allowing any authenticated WordPress user — including those with the lowest subscriber role — to invoke these actions. An attacker sends crafted AJAX POST requests to the WordPress admin-ajax.php endpoint targeting these unprotected actions, bypassing any administrative access controls. The vulnerable code is visible in the plugin source at popoveroptions.php line 98 (Wordfence, Plugin Source).

Successful exploitation allows authenticated attackers with minimal privileges (subscriber-level) to arbitrarily modify the Popover Windows plugin's settings and displayed content, compromising the integrity of the affected WordPress site. There is no confidentiality or availability impact; the risk is limited to unauthorized data modification, such as altering popover messages or themes visible to site visitors. This could be leveraged for defacement, phishing content injection, or social engineering attacks targeting site users (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14395. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account on the target WordPress site, limiting opportunistic mass exploitation (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Popover Windows plugin version ≤1.2 using tools like WPScan or by checking the plugin's readme.txt file exposed at /wp-content/plugins/popover-windows/readme.txt.
2. Obtain Authenticated Access: Register or use an existing subscriber-level account on the target WordPress site (e.g., via open user registration).
3. Craft AJAX Request: Prepare a POST request to https://target-site.com/wp-admin/admin-ajax.php with the action parameter set to an unprotected handler such as pop_submit or poptheme_submit, along with desired plugin settings as POST body parameters.
4. Submit Request: Send the crafted request with valid WordPress authentication cookies (nonce may not be required due to missing checks), modifying the plugin's popover content or theme settings.
5. Verify Impact: Confirm that the popover displayed to site visitors reflects the attacker-controlled content, potentially used for phishing or defacement (Wordfence, Plugin Source).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=pop_submit or action=poptheme_submit originating from low-privilege user sessions.
• Logs: WordPress access logs showing repeated AJAX calls to admin-ajax.php with popover-related action parameters from subscriber-level accounts.
• Application: Unexpected changes to Popover Windows plugin settings or content in the WordPress admin panel not made by administrators.

Users should update the Popover Windows plugin to version 1.3 or later, which addresses the missing capability checks on the affected AJAX actions. As a temporary workaround, site administrators can disable the plugin until the update is applied, or restrict user registration to prevent untrusted subscriber accounts. Regularly auditing plugin settings for unauthorized changes is also recommended (Wordfence).