CVE-2025-14441: 
WordPress vulnerability analysis and mitigation

CVE-2025-14441 is a missing authorization vulnerability in the Popupkit (popup-builder-block) plugin for WordPress that allows authenticated attackers with Subscriber-level access or above to delete arbitrary subscriber records. It affects all versions of the plugin up to and including 2.2.0. The vulnerability was disclosed on January 6, 2026, with Wordfence as the reporting CNA. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Wordfence (Wordfence).

The root cause is CWE-862 (Missing Authorization): the permission_callback for the DELETE /subscribers REST API endpoint only validates the wp_rest nonce, confirming the request originates from a logged-in WordPress session, but does not verify whether the authenticated user has the capability to manage or delete subscriber data. Because any registered WordPress user (Subscriber role and above) can obtain a valid wp_rest nonce, they can craft a DELETE request to the /subscribers endpoint and remove arbitrary subscriber records without possessing administrative privileges. The vulnerable code is visible in the plugin source at includes/Routes/Subscribers.php lines 64 and 77 in version 2.2.0 (Wordfence, WordPress Trac).

Successful exploitation allows any authenticated WordPress user — including those with the lowest default role (Subscriber) — to permanently delete arbitrary subscriber records managed by the Popupkit plugin. This results in an integrity impact through unauthorized data destruction, potentially wiping email subscriber lists used for marketing or communications. There is no confidentiality or availability impact reported, and the vulnerability does not facilitate lateral movement or privilege escalation beyond subscriber data deletion (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session on the target WordPress site, limiting opportunistic mass exploitation (Wordfence).

1. Obtain authenticated access: Register or log in to the target WordPress site with any account at Subscriber level or above.
2. Retrieve a wp_rest nonce: Load any WordPress page that includes the REST API nonce (e.g., via wp.apiFetch or by inspecting page source/network requests for nonce values associated with REST API calls).
3. Identify subscriber record IDs: If subscriber IDs are discoverable (e.g., through other plugin endpoints or enumeration), note the target subscriber record identifiers.
4. Send DELETE request: Issue an authenticated HTTP DELETE request to the plugin's REST API endpoint (e.g., DELETE /wp-json/<namespace>/subscribers/<id>) with the X-WP-Nonce header set to the retrieved nonce.
5. Confirm deletion: Verify that the targeted subscriber record has been removed from the plugin's subscriber list, confirming successful exploitation (Wordfence, WordPress Trac).

• Network: Unusual HTTP DELETE requests to the WordPress REST API endpoint path matching /wp-json/*/subscribers/* originating from low-privileged user sessions.
• Logs: WordPress or web server access logs showing repeated DELETE method requests to the Popupkit subscribers endpoint from authenticated but non-administrative user accounts.
• Application: Unexpected mass reduction or complete deletion of subscriber records in the Popupkit plugin's subscriber database table without corresponding administrative activity.

Users should update the Popupkit (popup-builder-block) plugin to a version beyond 2.2.0 that includes a corrected permission_callback enforcing proper capability checks (e.g., manage_options or an equivalent role check) on the DELETE /subscribers endpoint. The patch is visible in the plugin's trunk repository (WordPress Trac Changeset). As a temporary workaround, site administrators can restrict user registration or disable the Popupkit plugin until a patched version is applied (Wordfence).

The vulnerability was reported by Wordfence and received routine coverage from vulnerability aggregation platforms including Vulners, CVEFeed, and INCIBE-CERT. No notable researcher commentary, vendor statements beyond the Wordfence advisory, or significant social media discussion has been identified for this CVE.