{"id":"CVE-2026-100159","kind":"vulnerability","aliases":["CVE-2026-100159"],"related":[],"title":"WordPress Popup Box plugin: request headers run arbitrary shortcodes unauthenticated","description":"The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.","summary":"The Popup Box plugin for WordPress (versions 6.4.1 to 6.4.2) takes the client IP from attacker-controlled headers such as X-Forwarded-For and places it into popup content, then runs that content through do_shortcode(). An unauthenticated attacker can execute any registered shortcode on the site with attacker-chosen attributes, which can expose data or trigger other shortcode actions.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["default-config","plugin-not-installed"],"how_to_check":"- Check the installed Popup Box plugin version in the WordPress admin plugins list or with `wp plugin get popup-box --field=version` (plugin slug unknown from sources; confirm it)\n- Search popup content (Custom Content body) for the token `%%user_ip_address%%`\n- unknown whether other checks are needed","fix":"- Update the Popup Box plugin to a version later than `6.4.2` (exact fixed version unknown from sources)\n- Remove the `%%user_ip_address%%` token from popup Custom Content bodies until patched","status":"open","published_at":"2026-10-16T03:17:58+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:34:50+00:00","updated_at":"2026-10-25T04:34:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:34:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Popup Box plugin to a version later than `6.4.2` (exact fixed version unknown from sources)\n- Remove the `%%user_ip_address%%` token from popup Custom Content bodies until patched","reach":"internet","title":"WordPress Popup Box plugin: request headers run arbitrary shortcodes unauthenticated","impact":"medium","summary":"The Popup Box plugin for WordPress (versions 6.4.1 to 6.4.2) takes the client IP from attacker-controlled headers such as X-Forwarded-For and places it into popup content, then runs that content through do_shortcode(). An unauthenticated attacker can execute any registered shortcode on the site with attacker-chosen attributes, which can expose data or trigger other shortcode actions.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs registered shortcodes server-side, reading data or triggering actions","analyst_note":"Confirm the fixed plugin version and the exact plugin slug from the NVD entry or the vendor changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-100159.","how_to_check":"- Check the installed Popup Box plugin version in the WordPress admin plugins list or with `wp plugin get popup-box --field=version` (plugin slug unknown from sources; confirm it)\n- Search popup content (Custom Content body) for the token `%%user_ip_address%%`\n- unknown whether other checks are needed","needs_analyst":true,"not_affected_if":["default-config","plugin-not-installed"],"who_is_affected":"Sites running Popup Box versions 6.4.1 to 6.4.2 where an administrator has used the %%user_ip_address%% token in a popup's Custom Content body. Exposure also depends on which shortcodes the site has installed, since those are what an attacker can reach. Sites without the plugin, on other versions, or without that token in any popup are not affected by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":3626,"output_tokens":747,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-100159':13A,16A '-2026':12A,15A '6.4.1':32B,102C '6.4.2':34B,104C 'action':87B,256C 'add':232C 'address':169C,236C 'administr':230C 'appear':171C 'arbitrari':8A,97C,217C,251C 'attack':41B,65B,76B,214C,222C 'attacker-chosen':75B 'attacker-control':40B 'attacker-suppli':221C 'attribut':78B,224C 'autoemb':200C 'ay':110C,180C,196C,199C 'bodi':164C,191C,244C 'box':3A,27B,90C 'bracket':149C 'charact':153C 'chosen':77B 'client':37B,119C,122C 'client-control':118C 'client-ip':121C 'content':55B,59B,243C 'control':42B,120C 'custom':242C 'cve':11A,14A 'data':82B,182C,252C 'due':107C 'escap':178C 'execut':67B,99C,216C 'expos':81B,257C 'field':143C 'footer':206C 'forward':48B,126C,128C,131C,133C 'forwarded-for':132C 'function':115C 'get':112C 'header':6A,43B,136C 'hook':207C 'host':20B 'instal':260C 'ip':38B,114C,123C,168C,235C 'leverag':248C 'make':209C 'messag':184C 'output':202C 'packag':17B 'pass':188C 'pb':181C,197C 'perform':254C 'place':51B 'plugin':4A,24B,28B,91C 'popup':2A,26B,54B,89C,111C,163C,240C 'possibl':211C 'public':198C 'quot':150C 'raw':173C 'read':116C,250C 'regist':69B,218C 'replac':175C,183C 'request':5A,135C 'result':190C 'run':7A,57B 'sanit':137C,141C 'self':19B 'self-host':18B 'server':227C 'shortcod':9A,62B,70B,86B,98C,156C,194C,219C,259C 'site':73B,263C 'space':151C 'str':174C 'strip':147C 'substitut':158C 'suppli':223C 'syntax':157C 'take':35B 'text':142C 'token':170C,237C 'trigger':84B 'unauthent':10A,64B,213C 'use':154C 'user':113C,167C,234C 'valu':160C 'variabl':185C 'version':31B,101C 'vulner':95C 'whenev':228C 'wherev':165C 'wordpress':1A,21B,23B,30B,93C 'wordpress-plugin':22B 'wp':205C 'x':47B,125C,130C 'x-forward':129C 'x-forwarded-for':46B,124C","nicknames":[],"mitigations":[],"who_affected":"Sites running Popup Box versions 6.4.1 to 6.4.2 where an administrator has used the %%user_ip_address%% token in a popup's Custom Content body. Exposure also depends on which shortcodes the site has installed, since those are what an attacker can reach. Sites without the plugin, on other versions, or without that token in any popup are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100159","severity":null,"published_at":"2026-10-16T03:17:58+00:00","modified_at":"2026-10-16T15:16:58+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}