CVE-2025-24711 Overview
CVE-2025-24711 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wow-Company Popup Box plugin for WordPress. The flaw affects all versions of the popup-box plugin up to and including 3.2.4. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing actions in the plugin. The issue is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
A remote attacker can trick an authenticated administrator into performing unintended actions in the Popup Box plugin, leading to limited integrity and availability impact on affected WordPress sites.
Affected Products
- Wow-Company Popup Box (popup-box) WordPress plugin
- All versions from n/a through 3.2.4
- WordPress installations using the vulnerable plugin release
Discovery Timeline
- 2025-01-24 - CVE-2025-24711 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24711
Vulnerability Analysis
The Popup Box plugin exposes administrative actions without validating the origin of incoming requests. The plugin fails to enforce anti-CSRF tokens (WordPress nonces) on sensitive endpoints. An attacker hosts a crafted page containing a form or JavaScript request targeting the vulnerable plugin endpoint. When an authenticated WordPress user visits the page, the browser transmits the request along with valid session cookies. The plugin then processes the request as if it originated from a legitimate administrator action.
The EPSS score for this issue is 0.199%, reflecting a low observed probability of exploitation in the near term. However, CSRF issues in WordPress plugins remain a common pivot for adversaries targeting content management systems.
Root Cause
The root cause is missing or improperly validated CSRF protection on plugin request handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives to mitigate CSRF. The affected popup-box versions do not consistently invoke these checks before executing state-changing operations, permitting cross-origin requests to succeed.
Attack Vector
Exploitation occurs over the network and requires user interaction. The attacker must convince an authenticated WordPress user, typically an administrator or editor, to visit an attacker-controlled URL or click a crafted link. No authentication credentials are required from the attacker directly. The exploit leverages the victim's existing browser session against the target WordPress site.
No public proof-of-concept exploit or exploit database entry is available at the time of publication. Refer to the Patchstack Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-24711
Indicators of Compromise
- Unexpected modifications to Popup Box plugin configuration or popup content on the WordPress site
- HTTP POST requests to Popup Box endpoints containing a Referer header pointing to an external domain
- Administrator sessions generating plugin admin actions immediately after visiting an untrusted external site
- WordPress audit log entries showing plugin setting changes without corresponding admin dashboard access
Detection Strategies
- Deploy a WordPress security plugin or web application firewall (WAF) that logs and inspects Referer and Origin headers on wp-admin requests
- Monitor web server access logs for POST requests to popup-box admin endpoints lacking a valid nonce parameter
- Correlate authenticated administrator activity with browser referrer chains to identify cross-origin submissions
Monitoring Recommendations
- Enable WordPress activity logging to capture all plugin configuration changes with associated user context
- Alert on Popup Box option updates outside of expected administrative maintenance windows
- Track outbound HTTP requests from privileged user sessions to identify potential attacker landing pages
How to Mitigate CVE-2025-24711
Immediate Actions Required
- Update the Wow-Company Popup Box plugin to a version released after 3.2.4 that addresses CSRF handling
- Audit WordPress user accounts and disable inactive or unnecessary administrator accounts
- Instruct administrators to log out of WordPress before browsing untrusted websites
- Review the Patchstack Vulnerability Report for vendor-specific remediation guidance
Patch Information
The vulnerability affects Popup Box versions through 3.2.4. Site administrators should apply the latest available plugin release from the WordPress plugin repository. If no fixed version is currently published, deactivate and remove the plugin until a patched release is available.
Workarounds
- Deactivate the Popup Box plugin if a patched version is not yet available
- Deploy a WAF rule that enforces same-origin Referer and Origin header checks on wp-adminPOST requests
- Restrict administrative access to WordPress using IP allowlisting or VPN-based access controls
- Enforce short session lifetimes and require re-authentication for administrative actions
# Example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate popup-box
wp plugin delete popup-box
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
