Live › vulnerability › CVE-2026-100159
Go to dashboardThe Popup Box plugin for WordPress (versions 6.4.1 to 6.4.2) takes the client IP from attacker-controlled headers such as X-Forwarded-For and places it into popup content, then runs that content through do_shortcode(). An unauthenticated attacker can execute any registered shortcode on the site with attacker-chosen attributes, which can expose data or trigger other shortcode actions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Popup Box versions 6.4.1 to 6.4.2 where an administrator has used the %%user_ip_address%% token in a popup's Custom Content body. Exposure also depends on which shortcodes the site has installed, since those are what an attacker can reach. Sites without the plugin, on other versions, or without that token in any popup are not affected by this description.
No product ranges from the sources yet.
wp plugin get popup-box --field=version (plugin slug unknown from sources; confirm it)%%user_ip_address%%6.4.2 (exact fixed version unknown from sources)%%user_ip_address%% token from popup Custom Content bodies until patchedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-100159")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.