The WowOptin: Next-Gen Popup Maker WordPress plugin prior to version 1.4.38 lacks proper authorization checks on a REST API endpoint. This allows unauthenticated attackers to perform unauthorized actions such as disabling all opt-in forms on the affected site and inserting new opt-in templates into the database. The vulnerability is identified as CWE-284, indicating improper access control. There is no CVSS score assigned and no vendor advisory or patch information is currently available.

An attacker can disable all opt-in forms on a WordPress site using the vulnerable WowOptin plugin, potentially disrupting marketing or user engagement activities. Additionally, the attacker can insert new opt-in templates into the database, which may be used to manipulate or spoof opt-in forms. This could lead to loss of functionality and possible user trust issues. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API endpoints if possible and monitor for suspicious activity related to opt-in form management. Avoid exposing the vulnerable plugin on publicly accessible sites without additional access controls.