The Popupkit plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in its REST API endpoint for deleting subscribers. Specifically, the DELETE /subscribers endpoint validates only the wp_rest nonce but fails to check the user's capabilities, enabling any authenticated user with Subscriber-level privileges or above to delete subscriber data arbitrarily. This affects all versions up to and including 2.2.0. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low attack complexity and limited impact confined to integrity loss without confidentiality or availability impact.

An attacker with at least Subscriber-level access to the WordPress site can delete arbitrary subscriber records via the vulnerable REST API endpoint. This results in integrity loss of subscriber data but does not impact confidentiality or availability. There are no known exploits in the wild. The vulnerability does not allow privilege escalation or remote code execution.

Patch status is not yet confirmed — no official fix or vendor advisory is currently available. Until a patch is released, restrict Subscriber-level access to trusted users only and consider disabling or restricting access to the vulnerable REST API endpoint if possible. Monitor for updates from the vendor or security advisories for an official fix.