Popupkit WordPress Plugin Missing Authorization Vulnerability Allows Arbitrary Subscriber Data Deletion

A vulnerability exists in the Popupkit plugin for WordPress, specifically in versions through 2.2.0. The issue arises from a lack of proper authorization on the DELETE '/subscribers' REST API endpoint. The 'permission_callback' only verifies the wp_rest nonce without assessing user capabilities. This flaw enables authenticated users with Subscriber-level access or higher to delete any subscriber records.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of subscriber data.

Remediation

Users can update to version 2.2.1 or a newer patched version to address this vulnerability.