CVE-2026-27347
Received Received - Intake

Missing Authorization in Crocoblock JetPopup

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: Patchstack

Description
Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-27347
EUVD
EUVD-2026-70999

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
crocoblock jetpopup to 2.0.20.2 (inc)
crocoblock jetpopup 2.0.20.2
crocoblock jetpopup 2.0.20.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-27347 is a Missing Authorization vulnerability in the Crocoblock JetPopup WordPress plugin. It allows unauthenticated users to perform actions requiring higher privileges due to missing authorization checks. The vulnerability affects versions up to and including 2.0.20.2.

Detection Guidance

To detect this vulnerability, check the installed version of the JetPopup plugin in your WordPress admin panel under Plugins. If the version is 2.0.20.2 or below, the system is vulnerable. No specific commands are provided in the context, but you can verify the plugin version via the WordPress dashboard or database.

Impact Analysis

An attacker could exploit this to perform unauthorized actions in JetPopup without proper authentication. This may lead to data exposure, unintended modifications, or other security risks depending on the plugin's functionality.

Compliance Impact

This vulnerability allows unauthenticated users to perform actions requiring higher privileges due to missing authorization checks. While not directly tied to GDPR or HIPAA, such access control flaws could lead to unauthorized data exposure or modification, potentially violating compliance requirements for data protection and access controls.

Mitigation Strategies

Immediately update the JetPopup plugin to version 2.0.20.3 or later. If updating is not possible, disable the plugin temporarily or seek assistance from your hosting provider or developer. Enable auto-updates for vulnerable plugins if using Patchstack.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27347. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart