CVE-2025-68502

MediumCVSS 4.3

Published: 29/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The JetPopup plugin by Crocoblock is vulnerable to authorization bypass through user-controlled key, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.0.20.1.

Risk Assessment

An attacker can gain access to functions or data they should not have permissions for, potentially leading to unauthorized changes or information disclosure.

Recommendation

Update the JetPopup plugin to the latest patched version. Review access control configuration and restrict permissions.

Other vulnerabilities in JetPopup

CVE-2026-27347Medium
JetPopup plugin by Crocoblock contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Affects versions through 2.0.20.2.

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetPopup: from n/a through <= 2.0.20.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS