Arbitrary Shortcode Execution Vulnerability in Popup Box Plugin for WordPress

CVE-2026-100159

What is CVE-2026-100159?

The Popup Box plugin for WordPress contains a vulnerability that allows for arbitrary shortcode execution. This issue is rooted in the handling of client-controlled headers such as Client-IP and X-Forwarded-For. The vulnerable function ays_popup_get_user_ip() only applies basic sanitization through sanitize_text_field() which fails to eliminate critical characters used in shortcode syntax. As a result, attackers can supply malicious attributes that execute arbitrary registered shortcodes when the %%user_ip_address%% token is included in a popup's Custom Content body. This poses a significant risk as it can be exploited to read sensitive data or execute other actions via the shortcodes present on the WordPress site.

References