The WowOptin: Next-Gen Popup Maker WordPress plugin before version 1.4.38 lacks proper authorization checks on a REST API endpoint. This improper access control vulnerability (CWE-284) enables unauthenticated attackers to disable all opt-in forms on the affected site and insert new template-based opt-in rows into the database. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network exploitable with no privileges or user interaction required, causing high confidentiality impact but no integrity or availability impact. No official patch or remediation guidance is currently provided in the available data.

An attacker can remotely and without authentication disable all opt-in forms on a vulnerable site, potentially disrupting marketing or user engagement workflows. Additionally, the attacker can insert new opt-in templates into the database, which could be used for malicious or misleading content injection. The confidentiality of data is highly impacted, but integrity and availability are not affected according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoints if possible and monitor for suspicious activity related to opt-in form management. Avoid exposing the vulnerable plugin on publicly accessible sites without additional protective controls.