Popup Box CVE-2026-100159

Exploitation requires that a site administrator has added the %%user_ip_address%% token to a Popup Box popup's Custom Content body - without this specific configuration the attacker-controlled header value is never rendered or passed to do_shortcode(), so default installations are not affected. Impact is further limited to shortcodes already registered by the site (the attacker can only invoke existing shortcodes with chosen attributes, not inject arbitrary PHP), and the value of the attack depends entirely on which shortcode-exposing plugins are installed. No authentication or user interaction is needed (PR:N/UI:N), but the dependence on non-default admin configuration is the primary limiting factor and the reason for the high attack complexity.

This is a genuinely limited-severity issue despite the 'RCE/Code Injection' framing, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, 4.8 Medium) correctly reflects that although the flaw is network-reachable and unauthenticated (PR:N), successful exploitation carries high complexity (AC:H) because it depends on a specific administrator-side precondition - the %%user_ip_address%% token must have been placed into a popup's Custom Content body - and the impact is bounded to whatever registered shortcodes already exist on the site (hence C:L/I:L and A:N, not a full System compromise). No EPSS score, KEV entry, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The 'RCE' tag overstates reality: this is arbitrary registered-shortcode execution with attacker-controlled attributes, not arbitrary OS/PHP code execution, so real-world impact is entirely contingent on which shortcode-exposing plugins are installed. Net assessment: a real but niche, lower-priority issue - patch in routine cycles rather than emergency, prioritizing sites known to use the IP token.

On a site where an administrator has inserted the %%user_ip_address%% token into a Popup Box popup's Custom Content, an unauthenticated attacker sends a normal page request with a crafted X-Forwarded-For (or Client-IP / Forwarded) header containing WordPress shortcode syntax; because sanitize_text_field() does not strip brackets, quotes, spaces, or '=', the payload survives into the popup body and is passed to do_shortcode() at wp_footer, causing the injected shortcode to execute with attacker-supplied attributes. No public exploit code is identified at time of analysis, and the high attack complexity stems from the required administrator configuration.