CVE-2026-27347

MediumCVSS 5.3

Published: 04/09/2026(UTC)Updated: 04/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

JetPopup plugin by Crocoblock contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Affects versions through 2.0.20.2.

Risk Assessment

Unauthorized users may gain access to functions they should not have permissions for, potentially leading to security breaches.

Recommendation

Update JetPopup to a version newer than 2.0.20.2 and review permission configuration.

Other vulnerabilities in JetPopup

CVE-2025-68502Medium
The JetPopup plugin by Crocoblock is vulnerable to authorization bypass through user-controlled key, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.0.20.1.

Original NVD description (English source)

Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS