CVE-2024-9061

🗓️ 16 Oct 2024 07:31:49Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 100 Views🌐 WEB

The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress contains a vulnerability allowing unauthenticated attackers to execute arbitrary shortcodes

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for Code Injection in Themehunk Wp_Popup_Builder	16 Oct 202407:57	–	githubexploit
Circl	CVE-2024-9061	16 Oct 202411:20	–	circl
CNNVD	WordPress Plugin The WP Popup Builder: Code Injection Vulnerability	16 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add	16 Oct 202407:31	–	cvelist
Kitploit	CVE-2024-9061	31 Oct 202617:58	–	kitploit
Nuclei	WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution	4 Nov 202602:04	–	nuclei
NVD	CVE-2024-9061	16 Oct 202408:15	–	nvd
osv_cve	CVE-2024-9061	16 Oct 202408:15	–	osv_cve
Patchstack	WordPress WP Popup Builder Plugin <= 1.3.5 is vulnerable to Content Injection	15 Oct 202400:00	–	patchstack
Patchstack	WordPress WP Popup Builder – Popup Forms and Marketing Lead Generation plugin <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability	15 Oct 202420:50	–	patchstack

NVD

Vulners

Vulnrichment

Node

themehunk wp_popup_builderRange<1.3.6wordpress

[
  {
    "vendor": "themehunk",
    "product": "WP Popup Builder – Popup Forms and Marketing Lead Generation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.3.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0cac1dc0-87dc-43eb-9db1-638a91200b43
plugins	www.plugins.trac.wordpress.org/changeset/3166506/wp-popup-builder

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Unauthenticated arbitrary shortcode execution via wp_ajax_nopriv_shortcode_Api_Add using POST to admin-ajax.php with action and shortcode parameters.	CWE-94
shortcode	request body	/wp-admin/admin-ajax.php	Unauthenticated arbitrary shortcode execution via wp_ajax_nopriv_shortcode_Api_Add using POST to admin-ajax.php with action and shortcode parameters.	CWE-94

17 Jun 2026 08:23Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.17.3 - 9.8

EPSS0.52266

SSVC

CWE-94