Unauthenticated REST Endpoint Allows Opt-in Form Disruption

CVE-2026-14603 is an authorization bypass vulnerability in the WowOptin WordPress plugin that exposes a REST endpoint without proper authentication checks. This flaw allows unauthenticated attackers to completely disable all opt-in forms on a website and inject arbitrary opt-in rows directly into the database. Any WordPress site running WowOptin before version 1.4.38 is vulnerable, making this particularly dangerous for organizations relying on popup forms for lead generation, user engagement, or critical business functions. The attack requires no credentials and can be executed remotely, making it trivially exploitable at scale.

While this CVE doesn't map to specific MITRE ATT&CK techniques in its current classification, Casky practitioners would detect the underlying attack patterns through skills aligned with CWE-284 (Improper Access Control). Security teams using Casky's Claude AI-powered analysis would identify reconnaissance activity probing REST endpoints for missing authorization checks, followed by anomalous database modifications from unexpected sources—patterns consistent with Application Layer attacks. Practitioners would see unauthorized POST/PUT requests to `/wp-json/` paths, suspicious database entries from unauthenticated sessions, and sudden deactivation of security-critical forms. Extended reasoning across Casky's 754 skills would flag this as a supply-chain risk requiring immediate plugin updates and WAF rules blocking unauthenticated REST access to plugin endpoints.