Popup Like Box CVE-2026-32428

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a low-barrier-to-entry attack requiring no privileges, no user interaction, and low complexity, but resulting only in integrity impact without confidentiality or availability losses. This network-accessible, unauthenticated attack vector represents real exploitability risk. However, the integrity impact is limited (I:L) and there is no confidentiality or availability impact, suggesting the vulnerability allows modification of non-critical data (such as popup display settings or Like box metadata) rather than full system compromise or data exfiltration. The CVSS score of 5.3 places this in the medium range, but the lack of EPSS or KEV status data in the provided intelligence indicates this may not yet be widely exploited in the wild or may not have active proof-of-concept code publicly available. Given that this is a plugin affecting WordPress deployments (a large attack surface), and the unauthenticated, low-complexity nature of the attack, organizations running this plugin should prioritize patching, but this is not an emergency-level critical vulnerability. The real-world risk depends heavily on what the plugin controls; if it manages sensitive site configurations, the risk is elevated; if it only affects cosmetic Facebook widget display, the risk is lower.

An unauthenticated attacker discovers the plugin is active on a WordPress site and identifies an unprotected AJAX endpoint or admin-ajax action handler exposed by the Ays Pro Popup Like box plugin. The attacker sends a crafted HTTP POST request to this endpoint with parameters modifying the plugin's Like box configuration, such as changing the Facebook page ID, redirect URL, or appearance settings, without providing any authentication credentials or valid nonce token. Because the plugin fails to verify authorization before processing the request, the modification is accepted and reflected on the site, allowing the attacker to redirect users to malicious content or deface the social widget display. This attack requires only network access and a single HTTP request, with no user interaction needed.