CVE-2026-3475: Instant Popup Builder RCE Vulnerability

CVE-2026-3475 Overview

The Instant Popup Builder plugin for WordPress contains an Unauthenticated Arbitrary Shortcode Execution vulnerability affecting all versions up to and including 1.1.7. This security flaw exists within the handle_email_verification_page() function, which improperly constructs shortcode strings from user-supplied GET parameters (token, email) and passes them directly to WordPress's do_shortcode() function without adequate sanitization of square bracket characters.

Critical Impact

Unauthenticated attackers can inject and execute arbitrary registered shortcodes by crafting malicious token parameters, potentially leading to unauthorized functionality execution, information disclosure, or further exploitation depending on other installed plugins with dangerous shortcode handlers.

Affected Products

• Instant Popup Builder WordPress Plugin versions ≤ 1.1.7
• WordPress installations with Instant Popup Builder active

Discovery Timeline

• 2026-03-19 - CVE-2026-3475 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-3475

Vulnerability Analysis

This vulnerability stems from insufficient input validation in the email verification workflow of the Instant Popup Builder plugin. The handle_email_verification_page() function accepts user-controlled GET parameters and incorporates them into dynamically constructed shortcode strings. While the plugin applies sanitize_text_field() and esc_attr() to the input, neither of these WordPress sanitization functions strip or escape square bracket characters ([ and ]), which are the delimiter characters used by WordPress's shortcode parsing system.

WordPress's shortcode regex pattern uses [^\\]\\/]* to match content inside shortcode tags. When a ] character appears in the token value, it prematurely closes the shortcode tag, allowing an attacker to inject additional shortcode syntax after the closing bracket. This effectively enables arbitrary shortcode execution within the context of the WordPress installation.

The vulnerability is classified under CWE-862 (Missing Authorization), as the affected init hook handler lacks proper authorization checks, allowing unauthenticated users to trigger the vulnerable code path.

Root Cause

The root cause is twofold: first, the handle_email_verification_page() function fails to sanitize or escape square bracket characters from user input before constructing shortcode strings; second, the function lacks authorization checks, allowing any unauthenticated user to access the vulnerable endpoint. The combination of improper input sanitization and missing authorization enables unauthenticated arbitrary shortcode execution.

Attack Vector

An attacker can exploit this vulnerability remotely via the network without requiring any authentication or user interaction. The attack involves crafting a malicious HTTP GET request to the email verification endpoint with a specially crafted token parameter. By including a ] character followed by arbitrary shortcode syntax in the token value, the attacker can inject and execute any registered shortcode on the WordPress installation.

The vulnerability mechanism involves WordPress's shortcode parsing behavior. When the malformed token containing ] is processed, it prematurely terminates the legitimate shortcode tag, and any subsequent text following the ] is parsed as new shortcode content. This allows attackers to invoke shortcodes that may perform sensitive operations, depending on what plugins and shortcodes are registered on the target site.

For detailed technical analysis, refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code.

Detection Methods for CVE-2026-3475

Indicators of Compromise

• Unusual HTTP GET requests to email verification endpoints containing square bracket characters ([ and ]) in the token parameter
• Web server access logs showing requests with shortcode-like syntax patterns (e.g., [shortcode_name]) in URL parameters
• Unexpected shortcode execution events in WordPress debug logs

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing square bracket characters in verification token parameters
• Monitor WordPress activity logs for unusual shortcode execution patterns or errors
• Review web server access logs for suspicious parameter values containing shortcode syntax
• Deploy SentinelOne Singularity to detect anomalous web server process behavior indicative of exploitation

Monitoring Recommendations

• Enable detailed WordPress debug logging to capture shortcode execution events
• Configure alerting for unusual HTTP request patterns targeting WordPress plugin endpoints
• Monitor for lateral movement or privilege escalation following potential exploitation

How to Mitigate CVE-2026-3475

Immediate Actions Required

• Update Instant Popup Builder plugin to a patched version (check the WordPress Changeset for patch details)
• If immediate patching is not possible, consider temporarily deactivating the Instant Popup Builder plugin
• Review registered shortcodes on your WordPress installation to assess potential impact from arbitrary shortcode execution
• Audit access logs for evidence of exploitation attempts

Patch Information

A security patch has been released to address this vulnerability. Review the WordPress Plugin Changeset for details on the fix. The patch should include proper sanitization of square bracket characters from user input and implementation of authorization checks on the affected endpoint.

Workarounds

• Temporarily disable the Instant Popup Builder plugin until patched
• Implement WAF rules to block requests containing [ or ] characters in the token and email GET parameters for the email verification endpoint
• Restrict access to WordPress email verification endpoints at the web server level if the email verification feature is not required

# Example Apache .htaccess rule to block suspicious shortcode injection attempts
# Add to your WordPress .htaccess file
RewriteEngine On
RewriteCond %{QUERY_STRING} (token|email)=.*(\[|\]) [NC]
RewriteRule .* - [F,L]