WordPress Popup Maker Plugin Authorization Bypass to RCE

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.22.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with editor-level access and above, to install and activate an arbitrary plugin from an attacker-controlled URL, leading to remote code execution. Exploitation requires that a valid Popup Maker Pro license is active on the target site and that Popup Maker Pro is not yet installed, as these conditions are necessary for the legacy v1/connect/info endpoint to issue the bearer token used to satisfy the install endpoint's only non-spoofable validation check.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Popup Maker plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up to 1.22.0. Authenticated users with editor-level permissions can exploit improper authorization checks to install and activate arbitrary plugins from attacker-controlled sources, leading to remote code execution on the WordPress instance. This vulnerability is particularly dangerous because it requires only basic authenticated access—a common entry point after credential compromise or through compromised user accounts—yet escalates to full system compromise. Any WordPress site running this popular plugin with multiple user accounts is at risk, especially those managing user access loosely or storing weak credentials.

Casky's 283 mapped security skills leverage Claude's extended reasoning to identify the attack chain spanning MITRE ATT&CK's Privilege Escalation (TA0004) and Persistence (TA0006) tactics. Practitioners using Casky would detect this pattern through findings showing: (1) unusual plugin installation requests originating from editor-level accounts, particularly those installing plugins from non-standard repositories; (2) authorization function calls missing proper capability verification before executing sensitive plugin operations; and (3) suspicious code execution following plugin activation that doesn't match organizational baselines. The platform's skill mapping would correlate these indicators across WordPress logs, file system changes, and runtime behavior, helping security teams distinguish legitimate plugin management from exploitation attempts and prioritize this high-severity authorization flaw for immediate patching.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-8848.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-8848

Casky has 283 skills that investigate the attack patterns behind CVE-2026-8848. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn