CVE-2024-9061

published 2024-10-16

CVE-2024-9061: The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the…

Priority P1 82 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. NOTE: This vulnerability was partially fixed in version 1.3.5 with a nonce check, which effectively prevented access to the affected function. However, version 1.3.6 incorporates the correct authorization check to prevent unauthorized access.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
themehunk	wp_popup_builder	< 1.3.6	1.3.6
themehunk	wp_popup_builder_popup_forms_and_marketing_lead_generation	<= 1.3.5	—

Detection & IOCs extracted from sources · hover to see the quote

url /wp-admin/admin-ajax.php↗

command action=shortcode_Api_Add&shortcode=%43%56%45%2d%32%30%32%34%2d%39%30%36%31↗

path /wp-content/plugins/wp-popup-builder/↗

• → Exploit targets the unauthenticated AJAX action 'wp_ajax_nopriv_shortcode_Api_Add' via POST to /wp-admin/admin-ajax.php with parameter action=shortcode_Api_Add. Detect unauthenticated POST requests to admin-ajax.php containing this action parameter. ↗
• → Successful exploitation returns a response body of exactly 13 bytes with content-type text/html and HTTP 200. Monitor for anomalously short responses to admin-ajax.php shortcode_Api_Add requests. ↗
• → Presence of the plugin can be fingerprinted by checking page body for the string '/wp-content/plugins/wp-popup-builder/', usable as a pre-check before attempting exploitation. ↗
• → Affected versions are 1.3.5 and below. Version 1.3.6 contains the correct authorization check. Audit installed plugin versions for wp-popup-builder <= 1.3.5. ↗

• · Version 1.3.5 introduced a nonce check that partially mitigated the issue but did not fully prevent unauthorized access; only 1.3.6 adds the correct authorization check. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94