CVE-2026-100159 ays-pro CVE debrief

Who should care

Defenders managing WordPress installations with the Popup Box plugin, especially versions 6.4.1 to 6.4.2, should assess exposure and prioritize verification and remediation. Security teams and administrators responsible for WordPress site security should review popup configurations and monitor for suspicious activity.

Why it matters

CVE-2026-100159 allows unauthenticated attackers to execute arbitrary shortcodes with supplied attributes on WordPress sites using the vulnerable Popup Box plugin. Defenders should verify exposure, review popup configurations, and monitor for suspicious activity.

• An attacker could leverage this vulnerability to read arbitrary data or perform actions exposed by shortcodes installed on the site.
• Defenders need to verify if administrators have added the %%user_ip_address%% token to any popup's Custom Content body.
• Remediation priority is high for WordPress installations using the Popup Box plugin, versions 6.4.1 to 6.4.2.

Technical summary

The Popup Box plugin for WordPress is vulnerable to arbitrary shortcode execution due to improper sanitization of client-controlled request headers. The ays_popup_get_user_ip() function reads headers like Client-IP / X-Forwarded-For, sanitizes them with sanitize_text_field(), and substitutes the value into a popup body without escaping. This allows unauthenticated attackers to execute arbitrary registered shortcodes with supplied attributes when an administrator has added the %%user_ip_address%% token to a popup's Custom Content body.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Popup Box plugin, especially versions 6.4.1 to 6.4.2, and assess if administrators have added the %%user_ip_address%% token to any popup's Custom Content body.

Recommended defensive actions

• Verify WordPress installations for Popup Box plugin version 6.4.1 to 6.4.2 and update to a fixed version if possible.
• Review popup configurations for the %%user_ip_address%% token in Custom Content bodies and remove or modify as necessary.
• Monitor for suspicious shortcode execution attempts on the server.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Source references include links to the WordPress plugin files and a Wordfence threat intel page. The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes with supplied attributes on WordPress sites using the vulnerable Popup Box plugin. Defenders should verify exposure, review popup configurations, and monitor for suspicious activity. The ays_popup_get_user_ip() function reads client-controlled request headers, sanitizes them with sanitize_​_​

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.