CVE-2026-100159: Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitizetextfield() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%useripaddress%% token appears (a raw strreplace with no escaping in AysPbData::replacemessagevariables()), and then passing the resulting body to doshortcode() in AysPbPublic::aysautoembed() at output on the wpfooter hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%useripaddress%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Exposure requires Popup Box 6.4.1 or 6.4.2 and a popup using Custom Content that contains the %%user_ip_address%% token. Sites without that token in a popup body are not described as affected by this injection path.
What does an attacker need to do?
An attacker does not need authentication or user interaction. They must be able to send a request to the site with a crafted Client-IP, X-Forwarded-For, Forwarded, X-Forwarded, or Forwarded-For header; exploitation also depends on the required popup configuration being present.
What can be done while patching is delayed?
Remove the %%user_ip_address%% token from popup Custom Content bodies to break the described data flow. Do not rely on the plugin's existing header sanitization, because it does not remove the shortcode syntax characters identified in the issue.
How can administrators check whether they are affected?
Review Popup Box Custom Content for the %%user_ip_address%% token, particularly in popups shown through the site footer. Also confirm whether the installed Popup Box version is 6.4.1 or 6.4.2.