CVE-2025-14895

The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete analytics data including device types, browser information, countries, referrer URLs, and campaign metrics.

• CWE-862

• https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.2.0/includes/Routes/Popup.php#L145
• https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.2.0/includes/Routes/Popup.php#L32
• https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.2.0/includes/Routes/Popup.php#L85
• https://plugins.trac.wordpress.org/changeset/3421671/popup-builder-block/trunk/includes/Routes/Popup.php
• https://research.cleantalk.org/cve-2025-14895
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c13bb699-f065-4065-9ea5-bb86d24e09ab?source=cve

Published

Feb 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14889A security flaw has been discovered in Campcodes Advanced Vo…6.3
• CVE-2025-1489The WP-Appbox plugin for WordPress is vulnerable to Stored C…5.4
• CVE-2025-14891The Customer Reviews for WooCommerce plugin for WordPress is…6.4
• CVE-2025-14892The Prime Listing Manager WordPress plugin through 1.1 allow…9.8
• CVE-2025-14893The IndieWeb plugin for WordPress is vulnerable to Stored Cr…6.4
• CVE-2025-14894Livewire Filemanager, commonly used in Laravel applications,…9.8
• CVE-2025-14896due to insufficient sanitazation in Vega’s `convert()` funct…8.7
• CVE-2025-14897A vulnerability was identified in CodeAstro Real Estate Mana…7.2
• CVE-2025-14898A security flaw has been discovered in CodeAstro Real Estate…7.2
• CVE-2025-14899A weakness has been identified in CodeAstro Real Estate Mana…7.2
• CVE-2025-1490The Smart Maintenance Mode plugin for WordPress is vulnerabl…6.1
• CVE-2025-14900A security vulnerability has been detected in CodeAstro Real…7.2