The Popup Maker WP plugin versions from 1.2.2.1 through 1.4.5 do not enforce authorization checks on multiple actions, exposing the management interface to all logged-in users regardless of privilege level. This flaw enables low-privileged users to inject display-targeting values that are executed as zero-argument PHP callables during public page loads. The vulnerability can result in sensitive information disclosure and denial of service conditions. The CVSS 3.1 score is 5.4 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L. No known exploits are reported in the wild, and no official patch or remediation details are provided in the input data.

Exploitation allows any logged-in user, including those with minimal privileges such as Subscribers, to manipulate display-targeting values that are executed as PHP callables on public pages. This can lead to disclosure of sensitive information and denial of service. The impact is limited to confidentiality and availability with no integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only, and consider disabling or limiting access to the Popup Maker WP management page. Monitor for updates from the plugin vendor regarding patches or official mitigations.