The Popover Windows plugin for WordPress suffers from a missing capability check on several AJAX actions (such as pop_submit and poptheme_submit) in all versions up to and including 1.2. This authorization bypass vulnerability (CWE-862) enables authenticated users with low-level privileges (subscriber and above) to modify plugin settings and content, potentially altering site behavior or appearance without proper authorization. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges but no user interaction, and impacting integrity only.

An attacker with subscriber-level access or higher can modify the plugin's settings and content without proper authorization. This could lead to unauthorized changes in site behavior or content presentation controlled by the plugin. There is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles carefully to limit subscriber-level access and monitor for unauthorized changes to plugin settings. Avoid granting unnecessary privileges to untrusted users.