CVE-2024-12158: WordPress Popup Plugin Auth Bypass Flaw

CVE-2024-12158 Overview

CVE-2024-12158 affects the Popup – MailChimp, GetResponse and ActiveCampaign Integrations plugin for WordPress. The plugin fails to enforce a capability check on the upc_delete_db_data AJAX action. All versions up to and including 3.2.6 are vulnerable. Unauthenticated attackers can invoke the action and delete plugin database data. The weakness is classified as Missing Authorization [CWE-862]. The issue affects data integrity for site administrators who rely on stored popup and subscription configuration data. No authentication or user interaction is required to reach the vulnerable endpoint.

Critical Impact
Unauthenticated attackers can send a crafted AJAX request to remove plugin database records, causing loss of popup and integration configuration data.

Affected Products

WordPress Popup – MailChimp, GetResponse and ActiveCampaign Integrations plugin (also known as Ultimate Popup Creator)
All versions up to and including 3.2.6
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-07 - CVE-2024-12158 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12158

Vulnerability Analysis

The plugin registers an AJAX handler bound to the upc_delete_db_data action. The handler executes a database deletion routine but omits a capability check such as current_user_can() and does not verify a nonce. WordPress exposes AJAX actions registered via wp_ajax_nopriv_ to unauthenticated visitors. Because the endpoint lacks authorization gating, any anonymous client can invoke it by sending a POST request to wp-admin/admin-ajax.php with the action parameter set to upc_delete_db_data. The result is unauthorized deletion of plugin-owned records in the WordPress database.

Root Cause

The root cause is Missing Authorization [CWE-862]. The upc_delete_db_data handler performs a destructive database operation without validating that the caller holds the required WordPress capability, and without verifying an anti-CSRF nonce. Sensitive state-changing endpoints must be gated by both an authenticated capability check and a nonce validation to comply with WordPress plugin security guidance.

Attack Vector

An attacker sends an unauthenticated HTTP POST request to the site's admin-ajax.php endpoint with action=upc_delete_db_data. No session cookie, API key, or user interaction is required. The attack is remotely exploitable over the network against any reachable WordPress site running an affected version. Impact is limited to integrity of plugin data; confidentiality and site availability are not directly affected, though loss of configuration data can disrupt marketing integrations.

No verified public proof-of-concept code has been published. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-12158

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the parameter action=upc_delete_db_data from unauthenticated sources
Unexpected removal of plugin configuration rows in WordPress database tables owned by the Ultimate Popup Creator plugin
WordPress error or debug logs showing plugin data reset events without corresponding administrator sessions

Detection Strategies

Inspect web server access logs for the upc_delete_db_data action string in admin-ajax.php requests
Enable database query logging or audit triggers on plugin tables to record deletion operations and their originating requests
Deploy a Web Application Firewall rule that blocks unauthenticated invocations of the upc_delete_db_data AJAX action

Monitoring Recommendations

Alert on any HTTP 200 response to admin-ajax.php with action=upc_delete_db_data where no authenticated session cookie is present
Baseline expected AJAX traffic to admin-ajax.php and flag anomalous spikes in destructive plugin actions
Correlate plugin configuration changes with administrator login events to detect out-of-band modifications

How to Mitigate CVE-2024-12158

Immediate Actions Required

Update the Popup – MailChimp, GetResponse and ActiveCampaign Integrations plugin to a version newer than 3.2.6 as soon as one is available on the WordPress plugin repository
If no fixed version is available, deactivate and remove the plugin until a patched release is published
Back up plugin database tables so configuration can be restored after a successful attack

Patch Information

At the time of publication, review the Wordfence Vulnerability Report and the WordPress Plugin Overview for the latest release notes. Administrators should apply any vendor update that adds a current_user_can() capability check and nonce verification to the upc_delete_db_data handler.

Workarounds

Block requests to admin-ajax.php containing action=upc_delete_db_data at the Web Application Firewall or reverse proxy layer
Restrict access to wp-admin/admin-ajax.php from untrusted IP ranges where feasible
Use a WordPress hardening plugin or custom mu-plugin to unregister the vulnerable AJAX action until an official patch is applied

bash

# Example nginx rule to block unauthenticated requests to the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($request_body ~* "action=upc_delete_db_data") {
            return 403;
        }
    }
}