---
id: "CVE-2026-100159"
kind: "vulnerability"
aliases: ["CVE-2026-100159"]
title: "WordPress Popup Box plugin: request headers run arbitrary shortcodes unauthenticated"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["default-config", "plugin-not-installed"]
published_at: "2026-10-16T03:17:58+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:34:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100159", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress Popup Box plugin: request headers run arbitrary shortcodes unauthenticated

The Popup Box plugin for WordPress (versions 6.4.1 to 6.4.2) takes the client IP from attacker-controlled headers such as X-Forwarded-For and places it into popup content, then runs that content through do_shortcode(). An unauthenticated attacker can execute any registered shortcode on the site with attacker-chosen attributes, which can expose data or trigger other shortcode actions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Popup Box plugin version in the WordPress admin plugins list or with `wp plugin get popup-box --field=version` (plugin slug unknown from sources; confirm it)
- Search popup content (Custom Content body) for the token `%%user_ip_address%%`
- unknown whether other checks are needed

## Fix

- Update the Popup Box plugin to a version later than `6.4.2` (exact fixed version unknown from sources)
- Remove the `%%user_ip_address%%` token from popup Custom Content bodies until patched

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100159

## From the sources

The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_