Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100159— Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers

Quick assessment

Affected
ays-pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Popup Box 插件在 6.4.1 至 6.4.2 版本中存在任意短代码执行漏洞。该漏洞源于 函数读取由客户端控制的 、 、 、 和 请求头，但仅使用 对其进行 sanitization（该函数不会移除短代码语法所使用的方括号 、引号 、空格 和等号 等字符），随后在 Ays_Pb_Data::replace_message_variables() 方法中通过原始字符串替换（未进行任何转义处理）将值插入到弹出框正文中，所有出现 标记的地方都会被替换。接着，在处理完成后的正文会被传递给 中

CVSS 4.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100159

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
Source: CVE Program / CVE List V5
Vulnerability Description
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ays-pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups 6.4.1 ~ 6.4.2 -

II. Public POCs for CVE-2026-100159

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100159

请登录查看更多情报信息。

Other References for CVE-2026-100159 (1)

IV. Related Vulnerabilities

Same product: Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
Same vendor: ays-pro
Same weakness: CWE-94

V. Comments for CVE-2026-100159

No comments yet

Leave a comment