Popover Windows WordPress Plugin Missing Authorization Vulnerability in AJAX Actions

A vulnerability exists in the Popover Windows plugin for WordPress, allowing unauthorized data modification. This issue arises from a lack of capability checks on several AJAX actions, such as 'pop_submit' and 'poptheme_submit', in all versions up to and including 1.2. As a result, authenticated attackers with subscriber-level access or higher can alter the plugin's settings and content.

Impact

Exploitation of this vulnerability allows authenticated users with subscriber-level access and above to unauthorizedly modify the Popover Windows plugin's settings and content.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.