CVE-2025-14446
Unauthorized Settings Reset in Popup Builder Plugin via Missing Capability Check
Publication date: 2025-12-13
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpres | popup_builder | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA. The vulnerability allows authenticated users with Subscriber-level access to reset plugin settings to defaults, which could potentially lead to unauthorized modification of data or disruption of expected plugin behavior. However, there is no explicit mention of data breaches, personal data exposure, or regulatory compliance impact in the provided resources.
Can you explain this vulnerability to me?
The vulnerability exists in the Popup Builder (Easy Notify Lite) WordPress plugin, where a missing capability check in the easynotify_cp_reset() function allows authenticated users with Subscriber-level access or higher to reset the plugin settings to their default values without proper authorization.
How can this vulnerability impact me? :
An attacker with at least Subscriber-level access can reset the plugin settings to default, potentially disrupting the intended functionality of the plugin, causing loss of customized configurations, and possibly impacting website behavior or user experience.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized AJAX requests to the easynotify_cp_reset() function endpoint, which resets plugin settings. Since the vulnerability allows authenticated users with Subscriber-level access and above to reset settings, you can look for POST requests to the AJAX action related to resetting settings. Additionally, checking for unexpected changes in the plugin settings or resets to default values can indicate exploitation. Specific commands are not provided in the resources, but you can use WordPress debug logs or web server logs to search for POST requests containing 'action=easynotify_cp_reset' or similar AJAX calls. Monitoring user roles performing these actions can help detect unauthorized resets. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable plugin's AJAX reset functionality by ensuring proper capability checks are enforced, such as limiting the easynotify_cp_reset() function to users with higher privileges than Subscriber. Updating the plugin to a version that patches this vulnerability (versions after 1.1.37) is recommended once available. As a temporary measure, you can disable or remove the Easy Notify Lite plugin if it is not essential. Additionally, monitor and audit user roles and permissions to prevent unauthorized users from exploiting this vulnerability. [1, 3]