CVE-2024-9061

🗓️ 16 Oct 2024 08:15:07Reported by [email protected]Type

The WP Popup Builder plugin for WordPress allows arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action, allowing unauthenticated attackers to execute arbitrary shortcodes up to version 1.3.5, partially fixed in 1.3.5 and completely fixed in 1.3.6

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Code Injection in Themehunk Wp_Popup_Builder	16 Oct 202407:57	–	githubexploit
Circl	CVE-2024-9061	16 Oct 202411:20	–	circl
CNNVD	WordPress plugin The WP Popup Builder 代码注入漏洞	16 Oct 202400:00	–	cnnvd
CVE	CVE-2024-9061	16 Oct 202407:31	–	cve
Cvelist	CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add	16 Oct 202407:31	–	cvelist
Nuclei	WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution	2 Jun 202610:14	–	nuclei
Patchstack	WordPress WP Popup Builder Plugin <= 1.3.5 is vulnerable to Content Injection	15 Oct 202400:00	–	patchstack
Patchstack	WordPress WP Popup Builder – Popup Forms and Marketing Lead Generation plugin <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability	15 Oct 202420:50	–	patchstack
Positive Technologies	PT-2024-39397 · WordPress · The Popup Builder	16 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9061	5 Feb 202504:19	–	redhatcve

NVD

Node

themehunk wp_popup_builderRange<1.3.6wordpress

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3166506/wp-popup-builder
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0cac1dc0-87dc-43eb-9db1-638a91200b43

30 Oct 2024 21:11Current

CVSS 3.17.3 - 9.8

EPSS0.89

CWE-94