CVE-2026-85004 Overview
CVE-2026-85004 is a broken access control vulnerability in the Popup Maker WordPress plugin through version 1.4.5. The plugin verifies a nonce on one of its account-connection actions but omits a capability check. Authenticated users with minimal privileges, such as Subscribers, can invoke the action and overwrite a site-wide option containing the linked service account and API configuration. That option should only be modifiable by administrators. The flaw is classified under CWE-284: Improper Access Control.
Critical Impact
Any authenticated low-privilege user can overwrite the plugin's service account and API configuration, enabling integration hijacking and tampering with popup delivery.
Affected Products
- Popup Maker WordPress plugin, all versions through 1.4.5
- WordPress sites allowing self-registration or any Subscriber-level accounts
- Sites with the Popup Maker account-connection feature configured
Discovery Timeline
- 2026-10-02 - CVE-2026-85004 published to the National Vulnerability Database
- 2026-10-02 - Last updated in NVD database
Technical Details for CVE-2026-85004
Vulnerability Analysis
The Popup Maker plugin exposes an authenticated AJAX handler responsible for linking an external service account and storing associated API configuration. The handler validates a WordPress nonce to confirm request origin, but does not call current_user_can() or an equivalent capability check before writing the option. Nonces authenticate request intent, not authorization level. Any authenticated session, including a Subscriber, can obtain a valid nonce from pages the user is permitted to view and submit it to the vulnerable endpoint.
The write target is a site-wide option storing the linked service account identifier and the API credentials or configuration consumed by the plugin. Overwriting it redirects the plugin's outbound integration calls, substitutes attacker-controlled credentials, or disables the integration entirely. Downstream popup logic relying on the configuration can be manipulated to serve attacker-chosen content or route analytics and lead data to an external endpoint.
Root Cause
The root cause is a missing authorization check [CWE-284] on a privileged state-changing action. The handler conflates nonce verification with access control. Nonces defend against cross-site request forgery; they do not restrict which authenticated roles may execute an action.
Attack Vector
Exploitation is network-based and requires an authenticated account with any role. The attacker loads a plugin-accessible page to harvest a valid nonce, then issues an AJAX POST to the account-connection action with crafted service account and API configuration values. The server persists the submitted values to the site-wide option without rejecting the low-privilege caller.
No exploitation code is published for this issue. See the WPScan Vulnerability Report for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-85004
Indicators of Compromise
- Unexpected changes to Popup Maker option rows in wp_options referencing the linked service account or API configuration.
- POST requests to admin-ajax.php from authenticated sessions tied to Subscriber or other non-administrative roles invoking the plugin's account-connection action.
- Outbound plugin integration traffic directed to unfamiliar hosts or using credentials not provisioned by an administrator.
Detection Strategies
- Review WordPress audit logs for update_option events touching Popup Maker configuration keys initiated by non-admin users.
- Correlate AJAX action names with the wp_capabilities of the invoking user; flag privileged actions executed by Subscribers or Contributors.
- Compare current plugin configuration against a known-good baseline on a scheduled interval.
Monitoring Recommendations
- Enable a WordPress activity logging plugin that captures option changes and AJAX action invocations with user context.
- Forward web server access logs and PHP error logs to a centralized log store for retrospective query against the vulnerable action.
- Alert on new user registrations followed shortly by requests to plugin-specific AJAX endpoints.
How to Mitigate CVE-2026-85004
Immediate Actions Required
- Inventory WordPress sites running Popup Maker and identify any instance at version 1.4.5 or earlier.
- Disable self-registration or restrict the Subscriber role on affected sites until a patched version is installed.
- Rotate any API credentials and service account tokens associated with the Popup Maker integration.
Patch Information
No fixed version is listed in the referenced advisory at the time of publication. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org changelog for a release that adds a current_user_can() capability check to the account-connection handler.
Workarounds
- Deactivate the Popup Maker plugin on sites that allow untrusted user registration until a patched version is available.
- Deploy a web application firewall rule that blocks the plugin's account-connection AJAX action for sessions lacking administrator capabilities.
- Audit existing user accounts and remove unused Subscriber-level accounts to reduce the exploitable population.
# Example: identify Popup Maker installations at or below 1.4.5 using WP-CLI
wp plugin list --name=popup-maker --fields=name,status,version
# Example: temporarily deactivate the plugin pending a patch
wp plugin deactivate popup-maker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
