CVE-2026-100159
Received Received - Intake

Arbitrary Shortcode Execution in Popup Box WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-100159
EUVD
EUVD-2026-102592

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ays-pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups 6.4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Popup Box WordPress plugin has a flaw where attackers can execute arbitrary shortcodes by manipulating HTTP headers like Client-IP or X-Forwarded-For. The plugin replaces %%user_ip_address%% tokens in popups with these header values without proper sanitization, allowing code execution when the popup is viewed.

Detection Guidance

Check WordPress sites running Popup Box plugin versions 6.4.1 to 6.4.2 for the presence of %%user_ip_address%% tokens in popup Custom Content bodies. Review server logs for unusual shortcode execution patterns or requests containing Client-IP, X-Forwarded-For, or similar headers.

Impact Analysis

An attacker could exploit this to run malicious shortcodes on your WordPress site, potentially stealing data, defacing content, or gaining unauthorized access. The attack requires an administrator to have used the %%user_ip_address%% token in a popup.

Compliance Impact

This vulnerability could potentially expose personally identifiable information (PII) if attackers leverage arbitrary shortcode execution to read sensitive data from the WordPress site. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if such data is involved.

Mitigation Strategies

Immediately update the Popup Box plugin to the latest version. Remove any %%user_ip_address%% tokens from popup Custom Content bodies. Disable the plugin if an update is unavailable. Monitor for unauthorized shortcode execution in server logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart