CVE-2024-47358: Popup Maker Auth Bypass Vulnerability

CVE-2024-47358 Overview

CVE-2024-47358 is a Missing Authorization vulnerability (CWE-862) affecting the Popup Maker WordPress plugin developed by Code-Atlantic. This broken access control flaw allows unauthenticated attackers to perform unauthorized actions within the plugin without proper permission checks.

Critical Impact

This vulnerability enables remote attackers to bypass authorization controls and perform privileged actions without authentication, potentially compromising WordPress site integrity.

Affected Products

• Code-Atlantic Popup Maker versions up to and including 1.19.2
• WordPress installations with the Popup Maker plugin (popup-maker)

Discovery Timeline

• 2024-11-01 - CVE-2024-47358 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2024-47358

Vulnerability Analysis

This vulnerability stems from missing authorization checks within the Popup Maker WordPress plugin. The flaw falls under CWE-862 (Missing Authorization), which occurs when a software system does not perform an authorization check when an actor attempts to access a resource or perform an action. In the context of WordPress plugins, this typically manifests when AJAX handlers or REST API endpoints fail to verify user capabilities before executing sensitive operations.

The Popup Maker plugin is widely used for creating and managing popups, modals, and overlays on WordPress sites. Due to the missing authorization controls, attackers can potentially manipulate popup configurations, access sensitive data, or perform administrative actions without proper authentication.

Root Cause

The root cause is improper implementation of access control mechanisms within the plugin's codebase. WordPress provides capability checking functions such as current_user_can() that should be used to verify user permissions before executing privileged operations. The affected versions of Popup Maker fail to implement these checks on certain endpoints, allowing any user—including unauthenticated visitors—to trigger actions that should be restricted to administrators or authorized users.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction to exploit. An attacker can remotely target a vulnerable WordPress installation by sending crafted requests to the plugin's endpoints that lack proper authorization checks.

The exploitation mechanism involves identifying unprotected AJAX actions or REST API endpoints within the Popup Maker plugin. Once identified, an attacker can send HTTP requests directly to these endpoints to perform unauthorized operations. The lack of nonce verification and capability checks means the server processes these requests without validating whether the requester has appropriate permissions.

For detailed technical information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-47358

Indicators of Compromise

• Unexpected changes to popup configurations or settings without administrator action
• Unusual AJAX requests targeting Popup Maker plugin endpoints in web server logs
• Modifications to popup content, triggers, or targeting rules by unauthorized users
• Abnormal POST requests to /wp-admin/admin-ajax.php with Popup Maker action parameters

Detection Strategies

• Monitor web server access logs for unauthorized requests to Popup Maker AJAX endpoints
• Implement Web Application Firewall (WAF) rules to detect and block exploitation attempts
• Review WordPress audit logs for configuration changes to popups made without proper authentication
• Configure intrusion detection systems to alert on suspicious patterns targeting WordPress plugin endpoints

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX actions and REST API requests
• Deploy endpoint detection and response (EDR) solutions to monitor for post-exploitation activity
• Regularly audit plugin configurations to identify unauthorized modifications
• Implement file integrity monitoring on WordPress installations to detect tampering

How to Mitigate CVE-2024-47358

Immediate Actions Required

• Update Popup Maker plugin to the latest version that addresses the authorization vulnerability
• Review and audit existing popup configurations for any unauthorized changes
• Implement Web Application Firewall rules to block exploitation attempts while patching
• Consider temporarily deactivating the plugin if immediate patching is not possible

Patch Information

Users should update the Popup Maker plugin to a version newer than 1.19.2 through the WordPress plugin repository. The update can be applied via the WordPress admin dashboard under Plugins → Installed Plugins → Popup Maker → Update Now.

For additional patch details and vulnerability information, consult the Patchstack Vulnerability Report.

Workarounds

• Restrict access to admin-ajax.php using server-level controls for untrusted sources
• Implement additional authorization layers through security plugins such as Wordfence or Sucuri
• Use IP-based access controls to limit who can access WordPress administrative endpoints
• Enable WordPress debug logging temporarily to monitor for exploitation attempts

# Add to .htaccess to restrict direct access to admin-ajax.php (use with caution)
<Files admin-ajax.php>
    <RequireAny>
        Require ip 192.168.1.0/24
        Require all granted
    </RequireAny>
</Files>