What is the CVSS score of EUVD-2026-42544?

EUVD-2026-42544 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Popup Maker are affected by EUVD-2026-42544?

Popup Maker WordPress plugin (all versions through 1.22.0) permits users with editor-level access to install arbitrary plugins, enabling full server code execution and data compromise.

How to fix or mitigate EUVD-2026-42544?

24 hours: Disable the Popup Maker plugin across all WordPress installations, or restrict editor role assignment to essential personnel only. 7 days: Audit all editor+ user accounts for unauthorized plugin installations; enforce multi-factor authentication on all administrative accounts. 30 days: Monitor Wordfence security advisories and WordPress.org for Popup Maker patch release; apply the update immediately upon availability.

Popup Maker EUVD-2026-42544

| CVE-2026-8848 HIGH

Missing Authorization (CWE-862)

2026-07-09 Wordfence

GHSA-hjcg-vxr5-fgc7

Authentication Bypass WordPress RCE Popup Maker Boost Sales Conversions Optins Subscribers With The Ultimate Wp Popup Builder

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Network RCE yields C/I/A:H, but the required editor privilege gives PR:H and the mandatory active-license-plus-Pro-not-installed precondition raises AC to H over the vendor's AC:L.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:40 vuln.today

CVE Published

Jul 09, 2026 - 07:55 nvd

HIGH 7.2

DescriptionCVE.org

The Popup Maker - Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.22.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with editor-level access and above, to install and activate an arbitrary plugin from an attacker-controlled URL, leading to remote code execution. Exploitation requires that a valid Popup Maker Pro license is active on the target site and that Popup Maker Pro is not yet installed, as these conditions are necessary for the legacy v1/connect/info endpoint to issue the bearer token used to satisfy the install endpoint's only non-spoofable validation check.

AnalysisAI

Remote code execution in the Popup Maker WordPress plugin (all versions through 1.22.0) allows authenticated attackers holding editor-level access or above to install and activate an arbitrary plugin from an attacker-controlled URL, resulting in full server-side code execution. The root cause is a missing authorization check (CWE-862) in the plugin's REST API Connect controller, whose install endpoint treats a bearer token - issued by the legacy v1/connect/info endpoint - as its only non-spoofable authorization gate. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as editor-level user

Delivery

Call legacy v1/connect/info endpoint

Exploit

Obtain issued bearer token

Execution

Replay token to plugin install endpoint

Persist

Install and activate attacker-hosted plugin

Impact

Execute arbitrary PHP on server

Access

Authenticate as editor-level user

Delivery

Call legacy v1/connect/info endpoint

Exploit

Obtain issued bearer token

Execution

Replay token to plugin install endpoint

Persist

Install and activate attacker-hosted plugin

Impact

Execute arbitrary PHP on server

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated user with editor-level access or above (CVSS PR:H) plus two site-state preconditions the description names explicitly: a valid Popup Maker Pro license must be active on the target, AND Popup Maker Pro must not yet be installed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), pushed high by RCE-level triple impact (C:H/I:H/A:H) despite the high-privilege requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has obtained an editor account on a WordPress site running Popup Maker with an active-but-uninstalled Pro license coaxes the legacy v1/connect/info endpoint into issuing a bearer token, then replays that token to the install endpoint pointed at a malicious plugin ZIP on their own server. WordPress installs and activates the attacker's plugin, executing arbitrary PHP and yielding full control of the site. …
Remediation	Upstream fix available (WordPress.org SVN changeset 3589134 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3589134%40popup-maker&new=3589134%40popup-maker); a released patched version above 1.22.0 is not independently confirmed from the provided data, so update Popup Maker to the latest available release once published and verify the version string exceeds 1.22.0. … Detailed patch versions, workarounds, and compensating controls in full report.