An improper access control vulnerability in the WowOptin: Next-Gen Popup Maker WordPress plugin allows unauthenticated attackers to manipulate site forms, presenting a high risk to application integrity.

This is an improper access control flaw categorized under CWE-284, stemming from missing authorization checks on a REST endpoint that can be triggered by unauthenticated attackers over the network.

A successful exploit allows unauthorized actors to disable all site opt-in forms and insert unverified template-based rows directly into the database, leading to potential service disruption and data tampering. The CVSS score of 7.5 reflects the high severity of network-based unauthorized state modification without requiring user interaction or privileges.

Immediate Action: Update the WowOptin: Next-Gen Popup Maker WordPress plugin to version 1.4.38 or later.

Proactive Monitoring: Monitor database query logs for unusual row insertions and inspect REST API traffic targeting plugin endpoints for unauthorized requests.

Compensating Controls: Deploy a Web Application Firewall rule to restrict access to vulnerable REST API endpoints associated with the plugin if immediate updating is not feasible.

Public Exploit Available: No - there is no confirmation of a public exploit in the provided data.

Organizations utilizing the WowOptin: Next-Gen Popup Maker plugin must apply the vendor provided update to version 1.4.38 immediately. Prompt remediation is critical to prevent unauthorized form manipulation and database tampering by external malicious actors.