CVE-2026-1165 Overview
CVE-2026-1165 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Popup Box plugin for WordPress in all versions up to and including 6.1.1. The flaw resides in the publish_unpublish_popupbox function, which verifies a self-created nonce rather than one submitted in the request. Unauthenticated attackers can change the publish status of popups by tricking a site administrator into clicking a malicious link. The vulnerability is tracked under [CWE-352] and was published to the National Vulnerability Database (NVD) on 2026-01-31.
Critical Impact
Attackers can manipulate the publish state of popups on affected WordPress sites by abusing an administrator session through a forged request.
Affected Products
- Popup Box plugin for WordPress, versions up to and including 6.1.1
- Plugin slug ays-popup-box distributed via the WordPress plugin repository
- Sites running WordPress installations with the vulnerable plugin active
Discovery Timeline
- 2026-01-31 - CVE-2026-1165 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-1165
Vulnerability Analysis
The vulnerability stems from a flawed nonce verification implementation inside the publish_unpublish_popupbox function. WordPress nonces are intended to bind a request to a specific user session and action, preventing cross-origin abuse. In the vulnerable code path, the plugin generates a nonce server-side and compares it against that same self-created value rather than validating a nonce supplied by the requesting client. This effectively disables CSRF protection on the publish and unpublish action. The flaw is classified under [CWE-352] Cross-Site Request Forgery.
Root Cause
The root cause is an incorrect application of the WordPress nonce API. A valid CSRF mitigation requires the server to issue a nonce, embed it in an authenticated form or request, and then verify the value submitted by the client against the expected one. The Popup Box plugin instead regenerates the nonce on the server during validation, so the check passes regardless of what the requesting browser submits. References to the vulnerable code are available in the WordPress Plugin Code Snippet and the WordPress Plugin List Class Code.
Attack Vector
An attacker hosts a crafted page or sends a link that triggers a state-changing request to the target WordPress admin endpoint responsible for publishing or unpublishing popups. If an authenticated administrator visits the attacker-controlled resource, the browser submits the forged request using the administrator's session cookies. Because the plugin does not validate a client-supplied nonce, the request succeeds and the popup publish state is toggled. The attack requires user interaction from an administrator but no authentication on the attacker's side.
The vulnerability is described in prose because no verified proof-of-concept code is available. Technical details can be reviewed in the Wordfence Vulnerability Report.
Detection Methods for CVE-2026-1165
Indicators of Compromise
- Unexpected changes to the publish or unpublish status of popups managed by the Popup Box plugin
- HTTP requests to Popup Box admin-action endpoints with Referer headers pointing to external or unrelated domains
- Administrator browser sessions making state-changing requests immediately after visiting third-party links or emails
Detection Strategies
- Inspect web server access logs for POST or GET requests to Popup Box admin handlers that originate from cross-origin referers
- Compare timestamps of popup status changes in the database with administrator authentication events to identify anomalies
- Audit installed plugin versions across the WordPress estate and flag any instance of ays-popup-box at version 6.1.1 or earlier
Monitoring Recommendations
- Enable WordPress audit logging to record administrative actions on the Popup Box plugin
- Monitor outbound clicks and email gateways for links targeting WordPress admin URLs containing Popup Box action parameters
- Alert on changes to plugin post types and publish state outside of normal administrative working hours
How to Mitigate CVE-2026-1165
Immediate Actions Required
- Update the Popup Box plugin to version 6.1.2 or later, which corrects the nonce verification logic
- Review popup publish status across all sites running the plugin and revert any unauthorized changes
- Instruct administrators to log out of WordPress before browsing untrusted links or to use a dedicated administrative browser profile
Patch Information
The vendor released version 6.1.2 of the Popup Box plugin to address CVE-2026-1165. The fix updates the publish_unpublish_popupbox function to validate a client-supplied nonce as required by the WordPress nonce API. Diff details are available in the WordPress Plugin Changeset Details.
Workarounds
- Deactivate the Popup Box plugin until version 6.1.2 or later can be installed
- Apply a web application firewall rule to require a valid Referer header matching the site origin for Popup Box admin actions
- Restrict administrator access to the WordPress admin interface using IP allow-listing or VPN-only access
# Configuration example: update Popup Box plugin via WP-CLI
wp plugin update ays-popup-box --version=6.1.2
wp plugin list --name=ays-popup-box --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
