The PopupKit plugin for WordPress suffers from a missing authorization check (CWE-862) on its /popup/logs REST API endpoint. This flaw permits authenticated users with low privileges (Subscriber and above) to bypass intended access controls, allowing them to read and delete sensitive analytics data collected by the plugin. The vulnerability affects all versions up to and including 2.2.0. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low complexity, requiring privileges but no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with Subscriber-level access can read and delete analytics data including device types, browser information, countries, referrer URLs, and campaign metrics. This compromises the confidentiality and integrity of the analytics data collected by the PopupKit plugin. There is no impact on system availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to the /popup/logs endpoint. Avoid granting Subscriber-level or higher access to untrusted users.