Popup Maker < 1.23.0 - Editor+ Arbitrary Plugin Installation

Description

The plugin does not properly verify that a user is authorized to install plugins. This makes it possible for authenticated attackers with Editor-level access and above to install and activate an arbitrary plugin from an attacker-controlled source, leading to remote code execution. Exploitation is only possible on sites that have an active Pro license while the Pro add-on is not yet installed.