CVE-2024-9061: WP Popup Builder plugin unauthenticated arbitrary shortcode execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no privileges or user interaction required, and a high EPSS score make this a critical pre-auth code injection risk despite no confirmed in-the-wild exploitation.

What it is

The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress allows unauthenticated attackers to run arbitrary shortcodes through the wp_ajax_nopriv_shortcode_Api_Add AJAX action because a value is passed to do_shortcode without proper validation. This affects all versions up to and including 1.3.5; version 1.3.5 added a nonce check that blocked the function, and 1.3.6 added the correct authorization check. Arbitrary shortcode execution on a WordPress site can expose data and trigger other plugin functionality, making it a serious pre-auth issue.

Impact

An unauthenticated attacker can execute arbitrary shortcodes on the target site, which can lead to disclosure of sensitive data and invocation of other installed plugins' shortcode handlers. Depending on the shortcodes available, this can escalate toward broader site compromise.

Attack surface

The flaw is reached remotely over HTTP through the wp_ajax_nopriv_shortcode_Api_Add AJAX endpoint, which is explicitly registered for unauthenticated users. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

No public exploitation is confirmed in this record: CVE-2024-9061 is not listed in CISA KEV and no ransomware use is documented, but EPSS is high at roughly 0.52 (98.9th percentile), indicating elevated likelihood of attempted exploitation. The references are a patch changeset and a Wordfence advisory, with no exploit-tag references.

What to do

• Update the WP Popup Builder plugin to version 1.3.6 or later, which adds the correct authorization check.
• If immediate patching is not possible, remove or disable the plugin until it can be updated.
• Add a WAF rule blocking or restricting requests to the wp_ajax_nopriv_shortcode_Api_Add AJAX action.
• Audit other installed plugins for shortcodes that perform sensitive actions, since arbitrary shortcode execution can chain into them.
• Verify the plugin version across all WordPress sites, including multisite installations, and confirm 1.3.5 is not treated as a full fix.

Detection

• Monitor web server and WordPress logs for POST requests to admin-ajax.php with action=shortcode_Api_Add, especially from unauthenticated clients.
• Alert on unusual or unexpected shortcode strings appearing in AJAX request parameters.
• Look for outbound or database activity following admin-ajax.php requests that matches known shortcode side effects.
• Check for the plugin version in use and flag any site still running 1.3.5 or earlier.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.