CVE-2026-8848: Popup Maker Authorization Bypass Leads to RCE via Arbitrary Plugin Install

Technical summary

CVE-2026-8848 is an authorization bypass vulnerability (CWE-862) affecting Popup Maker versions up to 1.22.0. The vulnerability stems from insufficient authorization checks in the plugin's endpoint handlers. Authenticated attackers with editor-level or higher privileges can abuse the legacy v1/connect/info endpoint to obtain a bearer token—a process that normally requires a valid Popup Maker Pro license and absence of the Pro plugin installation. Armed with this token, attackers can invoke the install endpoint without proper validation, allowing arbitrary plugin installation from attacker-controlled URLs. The resulting installed plugin executes with full WordPress privileges, enabling remote code execution.

Business impact

Compromised WordPress sites can be leveraged for data theft, malware distribution, payment processing fraud, or as infrastructure for launching attacks on site visitors and customers. For multi-site WordPress networks, a single compromised site can become a pivot point. Organizations relying on Popup Maker for e-commerce, lead generation, or customer engagement face potential downtime during incident response and cleanup. Regulatory exposure varies by industry: e-commerce sites may face PCI-DSS implications; healthcare and financial services may trigger breach notification requirements.

Affected systems

Popup Maker plugin versions 1.22.0 and earlier are affected. The vulnerability requires: (1) editor-level or higher user access, (2) an active valid Popup Maker Pro license, and (3) Popup Maker Pro not yet installed on the target site. Any WordPress instance meeting these three conditions is at risk.

Exploitability

Exploitability is moderate to high within the constrained threat model. The attack requires authentication (editor-level user account) and specific site configuration (active Pro license, Pro plugin not installed). An attacker must already have or acquire editor credentials—via credential theft, weak passwords, or phishing. Once inside, no further user interaction or social engineering is needed. The attack executes over the network with low complexity. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, suggesting active exploitation is not yet widespread, though the straightforward nature of the flaw makes rapid weaponization plausible.

Remediation

Update Popup Maker to a patched version released after July 9, 2026 (verify against the vendor advisory for exact version number). If immediate patching is not possible, restrict editor-level access to trusted users only and consider removing editor grants from accounts that do not require them. Disable the legacy v1/connect/info endpoint if possible through plugin settings or a Web Application Firewall. Audit active user roles on affected sites and revoke unnecessary privileges.

Patch guidance

Check the Popup Maker changelog and vendor advisory for versions released after July 9, 2026. Apply the update through the WordPress plugin dashboard or manually via SFTP. Before patching, back up your WordPress database and plugin files. After update, verify that Popup Maker functionality remains intact and that no unauthorized plugins are present. If you cannot identify a patched version from the vendor, contact Popup Maker support or the plugin developer directly.

Detection guidance

Monitor WordPress admin logs for plugin installation activity initiated by users with editor level access, particularly installations from external or suspicious URLs. Check the wp_options table for unusual bearer tokens or authentication artifacts added after suspicious dates. Audit the list of installed plugins for entries that appear unexpected or were installed outside normal change windows. Use WordPress security plugins or a SIEM solution to flag installation API calls from authenticated non-administrator users. Review server access logs for POST requests to /wp-admin/admin-ajax.php or plugin endpoints containing 'connect' or 'install' parameters.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH CVSS score (7.2), direct path to remote code execution, and the sensitive attack surface (plugin installation). While the threat actor must have editor-level credentials and the site must have specific configuration, the bar for initial compromise is lower than for zero-touch RCE attacks. WordPress sites are widespread attack targets, and plugin installation is a final-stage objective for many campaigns. Organizations running Popup Maker should treat this as priority despite its not yet appearing on KEV lists.

Risk score, explained

CVSS 3.1 score of 7.2 (HIGH) reflects high impact (confidentiality, integrity, availability all set to H), network accessibility (AV:N), low attack complexity (AC:L), and high privilege requirement (PR:H). The score is appropriate: while the attacker needs editor or higher access, that access alone—combined with the specific license configuration—is sufficient. The vulnerability does not require user interaction and will execute reliably in affected environments. Absence from KEV status does not reduce the technical severity; it reflects current observation of active exploitation.

Frequently asked questions