CVE-2024-9061

WP Popup Builder – Popup Forms and Marketing Lead Generation, a WordPress popup plugin by ThemeHunk, is vulnerable to unauthenticated arbitrary shortcode execution (CWE-94) through the shortcode_Api_Add AJAX action, which is registered for non-logged-in users via wp_ajax_nopriv_ and passes attacker-controlled input to do_shortcode without proper validation. An attacker triggers the flaw by sending a crafted request to the site's admin-ajax.php endpoint with the shortcode_Api_Add action and arbitrary shortcode content. This allows an unauthenticated attacker to execute any shortcode registered on the site, and depending on the shortcodes supplied by other installed plugins or themes, potentially disclose information, embed attacker-controlled content, or trigger code execution, which underpins the critical 9.8 CVSS score. All versions up to and including 1.3.5 are affected; version 1.3.5 added a nonce check that partially mitigated the flaw by blocking access to the function, but the correct authorization check only shipped in version 1.3.6. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 52.3% EPSS score (99th percentile) indicates a high probability of exploitation within the next 30 days.

What to do: Update WP Popup Builder to version 1.3.6 or later, which contains the proper authorization check; versions 1.3.5 and earlier remain exploitable by unauthenticated users. If updating immediately is not possible, block unauthenticated admin-ajax.php requests with the shortcode_Api_Add action via a WAF or security plugin, or temporarily deactivate the plugin. Site owners should review access logs for unauthenticated admin-ajax.php calls containing the shortcode_Api_Add action as an indicator of probing.