CVE-2024-9061

🗓️ 16 Oct 2024 07:31:49Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 62 Views🌐 WEB

The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress contains a vulnerability allowing unauthenticated attackers to execute arbitrary shortcodes

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Code Injection in Themehunk Wp_Popup_Builder	16 Oct 202407:57	–	githubexploit
Circl	CVE-2024-9061	16 Oct 202411:20	–	circl
CNNVD	WordPress plugin The WP Popup Builder 代码注入漏洞	16 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add	16 Oct 202407:31	–	cvelist
Nuclei	WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution	6 Jun 202603:01	–	nuclei
NVD	CVE-2024-9061	16 Oct 202408:15	–	nvd
Patchstack	WordPress WP Popup Builder Plugin <= 1.3.5 is vulnerable to Content Injection	15 Oct 202400:00	–	patchstack
Patchstack	WordPress WP Popup Builder – Popup Forms and Marketing Lead Generation plugin <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability	15 Oct 202420:50	–	patchstack
Positive Technologies	PT-2024-39397 · WordPress · The Popup Builder	16 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9061	5 Feb 202504:19	–	redhatcve

NVD

Vulners

Vulnrichment

Node

themehunk wp_popup_builderRange<1.3.6wordpress

[
  {
    "vendor": "themehunk",
    "product": "WP Popup Builder – Popup Forms and Marketing Lead Generation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.3.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3166506/wp-popup-builder
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0cac1dc0-87dc-43eb-9db1-638a91200b43

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Unauthenticated arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in WP Popup Builder	CWE-94
shortcode	request body	/wp-admin/admin-ajax.php	Unauthenticated arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in WP Popup Builder	CWE-94

08 Apr 2026 16:35Current

8.7High risk

Vulners AI Score8.7

CVSS 3.17.3 - 9.8

EPSS0.89

SSVC

CWE-94