The Popup Builder plugin for WordPress suffers from a missing capability check on all AJAX actions, classified as CWE-862 (Missing Authorization). This flaw permits authenticated attackers with minimal privileges (subscriber-level or above) to bypass authorization controls and perform unauthorized operations such as deleting subscriber data and importing subscribers. The import functionality can be abused to inject stored cross-site scripting payloads. The vulnerability has a CVSS v3.1 base score of 7.4, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The scope is changed, affecting confidentiality, integrity, and availability.

Successful exploitation allows attackers with subscriber-level access to modify or delete subscriber data without proper authorization, potentially leading to data loss and persistent cross-site scripting attacks. This compromises the confidentiality, integrity, and availability of subscriber information managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to subscriber management. Avoid importing subscriber data from untrusted sources to reduce risk of stored XSS exploitation.