CVE-2026-85004: Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect

Q: Who can exploit this issue?

An authenticated WordPress user with minimal privileges, including a Subscriber, can exploit it. No administrator role is required.

Q: What must an attacker do to exploit it?

The attacker needs a valid authenticated session and must invoke the sgpm_connect account-connection action with a valid nonce. The issue is caused by that action checking the nonce but not the user's capability.

Q: What can be changed through exploitation?

An attacker can overwrite a site-wide Popup Maker option containing the linked service account and API configuration. This setting should normally be restricted to administrators.

Q: Which versions are affected?

Popup Maker WordPress plugin versions through 1.4.5 are affected.

Published Oct 2, 2026

Updated

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option (the linked service account and API configuration) that should only be modifiable by administrators.

Affected Software

1 affected component

Popup Maker Popup Maker WordPress plugin<=1.4.5

Event History

Oct 2, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with minimal privileges, including a Subscriber, can exploit it. No administrator role is required.

What must an attacker do to exploit it?

The attacker needs a valid authenticated session and must invoke the sgpm_connect account-connection action with a valid nonce. The issue is caused by that action checking the nonce but not the user's capability.

What can be changed through exploitation?

An attacker can overwrite a site-wide Popup Maker option containing the linked service account and API configuration. This setting should normally be restricted to administrators.

Which versions are affected?

Popup Maker WordPress plugin versions through 1.4.5 are affected.

CVE-2026-85004: Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What must an attacker do to exploit it?

What can be changed through exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What must an attacker do to exploit it?

What can be changed through exploitation?

Which versions are affected?