What is the CVSS score of CVE-2026-8848?

CVE-2026-8848 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Popup Maker are affected by CVE-2026-8848?

Popup Maker WordPress plugin (all versions through 1.22.0) permits users with editor-level access to install arbitrary plugins, enabling full server code execution and data compromise.

How to fix or mitigate CVE-2026-8848?

24 hours: Disable the Popup Maker plugin across all WordPress installations, or restrict editor role assignment to essential personnel only. 7 days: Audit all editor+ user accounts for unauthorized plugin installations; enforce multi-factor authentication on all administrative accounts. 30 days: Monitor Wordfence security advisories and WordPress.org for Popup Maker patch release; apply the update immediately upon availability.

Popup Maker CVE-2026-8848

EUVD-2026-42544 HIGH

Missing Authorization (CWE-862)

2026-07-09 Wordfence

GHSA-hjcg-vxr5-fgc7

WordPress Authentication Bypass RCE Wordpress Plugin Popup Maker Boost Sales Conversions Optins Subscribers With The Ultimate Wp Popup Builder

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Network RCE yields C/I/A:H, but the required editor privilege gives PR:H and the mandatory active-license-plus-Pro-not-installed precondition raises AC to H over the vendor's AC:L.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:40 vuln.today

CVE Published

Jul 09, 2026 - 07:55 nvd

HIGH 7.2

DescriptionCVE.org

The Popup Maker - Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.22.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with editor-level access and above, to install and activate an arbitrary plugin from an attacker-controlled URL, leading to remote code execution. Exploitation requires that a valid Popup Maker Pro license is active on the target site and that Popup Maker Pro is not yet installed, as these conditions are necessary for the legacy v1/connect/info endpoint to issue the bearer token used to satisfy the install endpoint's only non-spoofable validation check.

AnalysisAI

Remote code execution in the Popup Maker WordPress plugin (all versions through 1.22.0) allows authenticated attackers holding editor-level access or above to install and activate an arbitrary plugin from an attacker-controlled URL, resulting in full server-side code execution. The root cause is a missing authorization check (CWE-862) in the plugin's REST API Connect controller, whose install endpoint treats a bearer token - issued by the legacy v1/connect/info endpoint - as its only non-spoofable authorization gate. Reported by Wordfence; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in Popup Maker's premium-onboarding machinery - the RestAPI Connect class and the Services\Connect handler (classes/RestAPI/Connect.php, classes/Controllers/RestAPI.php, classes/Services/Connect.php in the 1.22.0 and 1.21.5 tags). Popup Maker Pro is delivered by having the free plugin 'connect' to the vendor, then download and activate the Pro package; that connect flow issues a bearer token via the legacy v1/connect/info endpoint and later trusts that token at the install endpoint. Because the controller relies on this token as its sole meaningful authorization gate and never independently verifies that the requesting user is entitled to trigger a plugin install, any editor-or-above user who can reach the endpoints can drive the install-and-activate routine. CWE-862 (Missing Authorization) is the class of flaw: a capability check that should gate plugin installation is absent, and installing an arbitrary plugin on WordPress is functionally equivalent to arbitrary PHP execution. The affected package per CPE is cpe:2.3:a:danieliser:popup_maker_-_boost_sales,_conversions,_optins,_subscribers_with_the_ultimate_wp_popup_builder.

RemediationAI

Upstream fix available (WordPress.org SVN changeset 3589134 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3589134%40popup-maker&new=3589134%40popup-maker); a released patched version above 1.22.0 is not independently confirmed from the provided data, so update Popup Maker to the latest available release once published and verify the version string exceeds 1.22.0. Until a confirmed fixed release is applied, restrict who holds editor-level and higher roles, since that privilege is a prerequisite. Where feasible, avoid leaving a site in the exploitable state: either complete Popup Maker Pro installation so the legacy connect/info token-issuance path is no longer reachable in the pre-install state, or deactivate the free plugin on Pro-licensed sites that have not yet finished Pro installation (trade-off: popups stop rendering). As a compensating control, block or restrict external access to the plugin's REST API Connect routes under /wp-json via WAF or web-server rules - noting this can interfere with legitimate Pro onboarding. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e05d4320-01d0-40c4-9a9a-457171ef7f5c) for the authoritative fixed version.