CVE-2024-9061 is a code injection vulnerability in the themehunk WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress. It allows unauthenticated attackers to execute arbitrary shortcodes through the wp_ajax_nopriv_shortcode_Api_Add AJAX action due to insufficient validation before invoking do_shortcode. The issue affects all versions up to and including 1.3.5. A partial fix was introduced in version 1.3.5 using a nonce check, but the correct authorization check that fully mitigates the vulnerability was implemented in version 1.3.6.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes, which can lead to code injection. This may result in information disclosure, integrity violations, or availability impacts depending on the shortcode executed. The CVSS 3.1 base score is 7.3 (high), reflecting network attack vector, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Users should upgrade the WP Popup Builder plugin to version 1.3.6 or later, where the correct authorization checks have been implemented to prevent unauthorized shortcode execution. Version 1.3.5 includes a partial fix with a nonce check but does not fully resolve the issue. No other mitigations are recommended beyond applying the official update.