CVE-2026-24616: 
WordPress vulnerability analysis and mitigation

CVE-2026-24616 is a Missing Authorization vulnerability in the WP Popups (wp-popups-lite) WordPress plugin developed by Damian. The flaw allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. It affects WP Popups versions up to and including 2.2.0.5 (initially disclosed as affecting up to 2.2.0.3, later updated on April 1, 2026 to include 2.2.0.5). The vulnerability was first reported by Patchstack on January 23, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing sensitive operations. An attacker with a low-privileged WordPress account (e.g., Subscriber role) can send crafted network requests to trigger restricted functionality without proper authorization checks. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated user (Patchstack, NVD).

Successful exploitation results in a high confidentiality impact with no effect on integrity or availability, suggesting that attackers can access sensitive data or plugin-managed content that should be restricted to higher-privileged users. This could expose popup configurations, subscriber data, or other information managed by the WP Popups plugin. The scope is limited to the affected WordPress installation, but data exposure could facilitate further attacks if sensitive configuration details are revealed (NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2026-24616. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privileged) WordPress account on the target site, which limits opportunistic mass exploitation (Feedly).

1. Reconnaissance: Identify WordPress sites running the WP Popups (wp-popups-lite) plugin at version 2.2.0.5 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged WordPress account (e.g., Subscriber) on the target site.
3. Identify unprotected endpoints: Analyze the plugin's AJAX handlers or REST API endpoints that lack proper capability checks, which are the typical vectors for CWE-862 vulnerabilities in WordPress plugins.
4. Send unauthorized request: Craft and send an authenticated HTTP request (with valid nonce/cookie) to the vulnerable endpoint, bypassing the missing authorization check to access restricted plugin functionality or data.
5. Exfiltrate data: Retrieve sensitive information returned by the endpoint, such as popup configurations or other data managed by the plugin (Patchstack).

• Logs: WordPress access logs showing authenticated requests from low-privileged user accounts to WP Popups plugin AJAX endpoints (e.g., wp-admin/admin-ajax.php) with unexpected action parameters outside normal user workflows.
• Logs: Repeated or automated requests to plugin-specific REST API routes from the same low-privileged user account in a short time window.
• Network: Unusual outbound data transfers from the WordPress server following authenticated plugin endpoint requests, potentially indicating data exfiltration.

Users should update the WP Popups (wp-popups-lite) plugin to a version beyond 2.2.0.5 that addresses this vulnerability. The CVE was initially reported against version 2.2.0.3 and later updated to cover 2.2.0.5, so administrators should verify they are running the latest available patched release from the WordPress plugin repository. As a temporary workaround, site administrators can restrict user registration or limit low-privileged account creation to reduce the attack surface until a patch is applied (Patchstack, NVD).