CVE-2026-100159 (GCVE-0-2026-100159)
Vulnerability from cvelistv5
Published
2026-10-16 02:26
Modified
2026-10-16 15:09
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.
References
Impacted products
Vendor Product Version
ays-pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups Version: 6.4.1   ≤ 6.4.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100159",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:50:08.374687Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:09:41.509Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups",
          "vendor": "ays-pro",
          "versions": [
            {
              "lessThanOrEqual": "6.4.2",
              "status": "affected",
              "version": "6.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "YC_Infosec"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or \u0027=\u0027 characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup\u0027s Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T02:26:09.256Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:34:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T13:57:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100159",
    "datePublished": "2026-10-16T02:26:09.256Z",
    "dateReserved": "2026-09-25T12:19:23.903Z",
    "dateUpdated": "2026-10-16T15:09:41.509Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-100159\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T14:50:08.374687Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:00:40.216Z\"}}], \"cna\": {\"title\": \"Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"YC_Infosec\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 4.8, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"ays-pro\", \"product\": \"Popup Box \\u2013 Create Countdown, Coupon, Video, Contact Form Popups\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.4.2\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-25T12:34:28.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-10-15T13:57:16.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or \u0027=\u0027 characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup\u0027s Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-10-16T02:26:09.256Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-100159\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-16T15:09:41.509Z\", \"dateReserved\": \"2026-09-25T12:19:23.903Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-10-16T02:26:09.256Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.