CVE-2026-1165
CSRF in WordPress Popup Box Plugin Allows Unauthorized Publish Changes
Publication date: 2026-01-31
Last updated on: 2026-01-31
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ays_popup_box | ays_popup_box | to 6.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Popup Box WordPress plugin (versions up to and including 6.1.1). It occurs because the 'publish_unpublish_popupbox' function verifies a nonce that it creates itself rather than verifying the nonce submitted in the request. This flaw allows an unauthenticated attacker to trick a site administrator into performing an unintended action, such as changing the publish status of popup boxes, by sending a forged request that the admin unknowingly executes. [1, 3]
How can this vulnerability impact me? :
The vulnerability allows an attacker to change the publish status of popup boxes on a WordPress site without proper authorization. This means an attacker could cause popups to be published or unpublished without the site administrator's consent, potentially leading to unauthorized content being displayed or legitimate content being hidden. Since the attacker must trick an administrator into clicking a malicious link, it can lead to unauthorized modifications of site content and affect site integrity. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves Cross-Site Request Forgery (CSRF) in the Popup Box WordPress plugin's 'publish_unpublish_popupbox' function due to flawed nonce verification. Detection would involve monitoring for unauthorized changes to popup publish status potentially triggered by forged requests. Since the plugin sanitizes and retrieves 'action' parameters and popupbox IDs, you can check WordPress admin logs or database entries for unexpected publish/unpublish actions. However, no specific network or system commands are provided in the resources to detect this vulnerability directly. You may consider auditing HTTP requests to the WordPress admin interface for suspicious POST requests that change popup statuses without valid nonces, but no explicit commands are given.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Popup Box plugin to a version later than 6.1.1 where the nonce implementation flaw in the 'publish_unpublish_popupbox' function is fixed. Since the vulnerability allows unauthenticated attackers to change popup publish status via forged requests, ensuring the plugin verifies the nonce submitted in the request properly will prevent CSRF attacks. Additionally, restrict administrative access to trusted users only and consider implementing Web Application Firewall (WAF) rules to block suspicious CSRF attempts targeting the popup publish/unpublish actions. [4]