CVE-2026-8848: Popup Maker Plugin Auth Bypass Vulnerability

CVE-2026-8848 Overview

CVE-2026-8848 is an authorization bypass vulnerability in the Popup Maker WordPress plugin, affecting all versions up to and including 1.22.0. The flaw allows authenticated attackers with editor-level access or above to install and activate arbitrary plugins from attacker-controlled URLs. Successful exploitation results in remote code execution on the affected WordPress site. The plugin fails to properly verify user authorization on a privileged install endpoint. Exploitation requires an active Popup Maker Pro license on the target site and that Popup Maker Pro is not yet installed. These preconditions are necessary for the legacy v1/connect/info endpoint to issue the bearer token used to satisfy the install endpoint's only non-spoofable validation check. The weakness is categorized under CWE-862: Missing Authorization.

Critical Impact
Editor-level attackers can install arbitrary plugins from attacker-controlled URLs, resulting in remote code execution and full compromise of the WordPress site.

Affected Products

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress
All plugin versions up to and including 1.22.0
Sites with an active Popup Maker Pro license where Popup Maker Pro is not yet installed

Discovery Timeline

2026-07-09 - CVE-2026-8848 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-8848

Vulnerability Analysis

The Popup Maker plugin exposes a REST API endpoint used to install and activate the companion Popup Maker Pro plugin. The install endpoint accepts a plugin download URL and installs the resulting archive. The endpoint's only non-spoofable validation check is the presence of a valid bearer token issued by the plugin itself. That bearer token can be obtained through the legacy v1/connect/info endpoint when the site has an active Popup Maker Pro license and Popup Maker Pro is not yet installed.

Because the install path does not restrict the plugin source to a trusted domain, authenticated attackers with editor-level access can point the install routine at an attacker-controlled URL. The uploaded archive is extracted, installed, and activated as a WordPress plugin, executing PHP code within the site's context.

Root Cause

The root cause is missing authorization enforcement in the REST API controller and connect service. Relevant code paths appear in classes/Controllers/RestAPI.php, classes/RestAPI/Connect.php, and classes/Services/Connect.php. The controller trusts a bearer token whose issuance conditions can be satisfied by an editor-level user rather than a site administrator. This design fails to enforce the WordPress capability model that reserves plugin installation for administrators.

Attack Vector

Exploitation requires network access to the WordPress REST API and authenticated editor-level credentials. The attacker first calls the legacy v1/connect/info endpoint to obtain a bearer token, which succeeds when a Popup Maker Pro license is active and Popup Maker Pro is not installed. The attacker then submits a request to the install endpoint referencing an attacker-controlled URL hosting a malicious plugin ZIP archive. The plugin is installed and activated, and the attacker's PHP payload executes with the privileges of the web server process.

Refer to the Wordfence Vulnerability Analysis for the full technical breakdown.

Detection Methods for CVE-2026-8848

Indicators of Compromise

Unexpected new plugins appearing in wp-content/plugins/ that were not installed by an administrator
HTTP requests to REST routes containing /popup-maker/v1/connect/info and subsequent install calls originating from editor accounts
Outbound HTTP requests from the WordPress host fetching plugin ZIP archives from unfamiliar external URLs
WordPress active_plugins option modifications outside change-management windows

Detection Strategies

Inspect web server access logs for REST API calls to Popup Maker connect and install endpoints originating from non-administrator sessions
Alert on WordPress plugin install events performed by users whose role is editor rather than administrator
Monitor file integrity for new files written under wp-content/plugins/ and correlate with the initiating user
Compare installed plugin inventories against an approved allowlist and flag deviations

Monitoring Recommendations

Enable WordPress audit logging that records REST API authentication, plugin installation, and plugin activation events
Forward web server and WordPress audit logs to a centralized SIEM for correlation with authentication anomalies
Track outbound network connections from the PHP process to detect retrieval of arbitrary plugin archives
Review Popup Maker Pro license state and installation status; unexpected changes may indicate reconnaissance for this bypass

How to Mitigate CVE-2026-8848

Immediate Actions Required

Update the Popup Maker plugin to a version later than 1.22.0 that contains the fix referenced in the WordPress plugin changeset
Audit all WordPress user accounts with editor-level access and above, removing unnecessary privileges
Review installed plugins for entries not authorized by an administrator and remove any suspicious plugins
Rotate credentials for editor-level and administrator accounts if compromise is suspected

Patch Information

The vendor addressed the authorization bypass in the release following 1.22.0. The fix is documented in the WordPress Changeset Update. The patched code enforces administrator-level capability checks before honoring plugin install requests through the REST API. Site owners should apply the update through the WordPress plugin update interface or by deploying the patched archive from the plugin repository.

Workarounds

Temporarily deactivate the Popup Maker plugin until the patched version is installed
Restrict access to the WordPress REST API from untrusted networks using a web application firewall rule that blocks calls to popup-maker/v1/connect/* and related install routes from non-administrator sessions
Downgrade editor-level accounts that do not require content publishing privileges, reducing the exploitable user population
If Popup Maker Pro is licensed, complete its installation through an administrator account to remove the precondition that allows the bearer token to be issued