CVE-2025-24711: Popup Box Plugin CSRF Vulnerability

CVE-2025-24711 Overview

CVE-2025-24711 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wow-Company Popup Box plugin for WordPress. The flaw affects all versions of the popup-box plugin up to and including 3.2.4. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing actions in the plugin. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
A remote attacker can trick an authenticated administrator into performing unintended actions in the Popup Box plugin, leading to limited integrity and availability impact on affected WordPress sites.

Affected Products

Wow-Company Popup Box (popup-box) WordPress plugin
All versions from n/a through 3.2.4
WordPress installations using the vulnerable plugin release

Discovery Timeline

2025-01-24 - CVE-2025-24711 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24711

Vulnerability Analysis

The Popup Box plugin exposes administrative actions without validating the origin of incoming requests. The plugin fails to enforce anti-CSRF tokens (WordPress nonces) on sensitive endpoints. An attacker hosts a crafted page containing a form or JavaScript request targeting the vulnerable plugin endpoint. When an authenticated WordPress user visits the page, the browser transmits the request along with valid session cookies. The plugin then processes the request as if it originated from a legitimate administrator action.

The EPSS score for this issue is 0.199%, reflecting a low observed probability of exploitation in the near term. However, CSRF issues in WordPress plugins remain a common pivot for adversaries targeting content management systems.

Root Cause

The root cause is missing or improperly validated CSRF protection on plugin request handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives to mitigate CSRF. The affected popup-box versions do not consistently invoke these checks before executing state-changing operations, permitting cross-origin requests to succeed.

Attack Vector

Exploitation occurs over the network and requires user interaction. The attacker must convince an authenticated WordPress user, typically an administrator or editor, to visit an attacker-controlled URL or click a crafted link. No authentication credentials are required from the attacker directly. The exploit leverages the victim's existing browser session against the target WordPress site.

No public proof-of-concept exploit or exploit database entry is available at the time of publication. Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-24711

Indicators of Compromise

Unexpected modifications to Popup Box plugin configuration or popup content on the WordPress site
HTTP POST requests to Popup Box endpoints containing a Referer header pointing to an external domain
Administrator sessions generating plugin admin actions immediately after visiting an untrusted external site
WordPress audit log entries showing plugin setting changes without corresponding admin dashboard access

Detection Strategies

Deploy a WordPress security plugin or web application firewall (WAF) that logs and inspects Referer and Origin headers on wp-admin requests
Monitor web server access logs for POST requests to popup-box admin endpoints lacking a valid nonce parameter
Correlate authenticated administrator activity with browser referrer chains to identify cross-origin submissions

Monitoring Recommendations

Enable WordPress activity logging to capture all plugin configuration changes with associated user context
Alert on Popup Box option updates outside of expected administrative maintenance windows
Track outbound HTTP requests from privileged user sessions to identify potential attacker landing pages

How to Mitigate CVE-2025-24711

Immediate Actions Required

Update the Wow-Company Popup Box plugin to a version released after 3.2.4 that addresses CSRF handling
Audit WordPress user accounts and disable inactive or unnecessary administrator accounts
Instruct administrators to log out of WordPress before browsing untrusted websites
Review the Patchstack Vulnerability Report for vendor-specific remediation guidance

Patch Information

The vulnerability affects Popup Box versions through 3.2.4. Site administrators should apply the latest available plugin release from the WordPress plugin repository. If no fixed version is currently published, deactivate and remove the plugin until a patched release is available.

Workarounds

Deactivate the Popup Box plugin if a patched version is not yet available
Deploy a WAF rule that enforces same-origin Referer and Origin header checks on wp-adminPOST requests
Restrict administrative access to WordPress using IP allowlisting or VPN-based access controls
Enforce short session lifetimes and require re-authentication for administrative actions

bash

# Example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate popup-box
wp plugin delete popup-box