CVE-2026-100159: WordPress Popup Box Plugin RCE Vulnerability

CVE-2026-100159 Overview

CVE-2026-100159 affects the Popup Box plugin for WordPress in versions 6.4.1 to 6.4.2. The flaw allows unauthenticated attackers to execute arbitrary registered shortcodes by injecting shortcode syntax through client-controlled HTTP headers. Exploitation requires that an administrator has placed the %%user_ip_address%% token inside a popup's Custom Content body. The plugin reads IP values from headers such as Client-IP, X-Forwarded-For, Forwarded, X-Forwarded, and Forwarded-For, then passes the resulting popup body to do_shortcode() without escaping. The vulnerability is tracked as improper control of code generation [CWE-94].

Critical Impact
Unauthenticated attackers can execute arbitrary registered shortcodes with attacker-supplied attributes, enabling data disclosure or other actions exposed by shortcodes installed on the site.

Affected Products

Popup Box plugin for WordPress version 6.4.1
Popup Box plugin for WordPress version 6.4.2
WordPress sites that render the %%user_ip_address%% token in a popup's Custom Content body

Discovery Timeline

2026-10-16 - CVE-2026-100159 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-100159

Vulnerability Analysis

The Popup Box plugin trusts untrusted HTTP headers when resolving the visitor IP address. The ays_popup_get_user_ip() function reads Client-IP, X-Forwarded-For, Forwarded, X-Forwarded, and Forwarded-For request headers directly from the client. Values are passed through sanitize_text_field(), which strips newlines and control characters but preserves brackets, quotes, spaces, and = characters used by WordPress shortcode syntax. The sanitized value is then substituted into a popup body using a raw str_replace call in Ays_Pb_Data::replace_message_variables() wherever the %%user_ip_address%% token appears. The resulting body is handed to do_shortcode() from Ays_Pb_Public::ays_autoembed() on the wp_footer hook, which executes any registered shortcode present in the string. Impact depends on which shortcodes are installed, but any shortcode exposing file reads, database queries, or privileged actions becomes reachable to anonymous requesters.

Root Cause

The root cause is use of a client-controlled input as code-generating content without shortcode-safe escaping. sanitize_text_field() is not a shortcode sanitizer, and the plugin does not call wp_kses or escape square brackets before invoking do_shortcode().

Attack Vector

An unauthenticated attacker sends an HTTP request to a page that renders the vulnerable popup. The attacker sets one of the trusted IP headers to a payload containing shortcode syntax such as [some_shortcode attr="value"]. When WordPress renders wp_footer, the plugin substitutes the header value into the popup body and executes the shortcode server-side.

See the WordPress Plugin Code Snippet and the patched 6.4.3 source for the vulnerable and corrected code paths.

Detection Methods for CVE-2026-100159

Indicators of Compromise

HTTP requests containing [ or ] characters inside Client-IP, X-Forwarded-For, Forwarded, X-Forwarded, or Forwarded-For headers.
Web server access logs showing requests to pages known to render Popup Box popups with unusual header values.
Unexpected shortcode execution artifacts in WordPress debug or PHP error logs tied to wp_footer output.

Detection Strategies

Inspect reverse proxy and WAF logs for shortcode syntax inside IP-related request headers.
Audit active Popup Box popups for use of the %%user_ip_address%% token in Custom Content bodies.
Correlate anonymous traffic bursts targeting pages hosting popups with abnormal response sizes or latency.

Monitoring Recommendations

Enable verbose web access logging that captures the full set of forwarded-IP request headers.
Alert on inbound HTTP headers containing [, ], or = characters where only an IP literal is expected.
Monitor WordPress plugin inventory for installations of Popup Box at versions 6.4.1 and 6.4.2.

How to Mitigate CVE-2026-100159

Immediate Actions Required

Upgrade the Popup Box plugin to version 6.4.3 or later on all WordPress sites.
Remove the %%user_ip_address%% token from Custom Content bodies until the upgrade is complete.
Review the Wordfence Vulnerability Report for additional guidance.

Patch Information

The maintainer addressed the issue in Popup Box 6.4.3. The fix is visible in the updated class-ays-pb-public.php. Administrators should apply the update through the WordPress plugin management console and verify the installed version afterwards.

Workarounds

Strip or reject inbound Client-IP, X-Forwarded-For, Forwarded, X-Forwarded, and Forwarded-For headers at the edge when they do not match a strict IP literal pattern.
Deploy a WAF rule that blocks requests containing shortcode syntax inside forwarded-IP headers.
Temporarily disable the Popup Box plugin on sites where upgrading is not immediately possible.

bash

# Example nginx rule: drop forwarded headers that are not valid IP literals
map $http_x_forwarded_for $xff_safe {
    "~^[0-9a-fA-F:.,\s]+$" $http_x_forwarded_for;
    default "";
}
proxy_set_header X-Forwarded-For $xff_safe;