CVE-2026-100159: CWE-94 Improper Control of Generation of Code ('Code Injection') in ays-pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups

CVE-2026-100159 is a code injection vulnerability (CWE-94) in the Popup Box plugin for WordPress, affecting versions 6.4.1 through 6.4.2. The vulnerability arises from the ays_popup_get_user_ip() function reading client-supplied IP-related headers and sanitizing them only with sanitize_text_field(), which does not remove characters used in shortcode syntax. The unsanitized input is substituted into popup content where the %%user_ip_address%% token appears, and then processed by do_shortcode() during output on the wp_footer hook. This allows unauthenticated attackers to execute arbitrary registered shortcodes with attacker-controlled attributes if an administrator has added the vulnerable token to popup content, potentially exposing data or performing other shortcode-exposed actions.

The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes on the server, which can lead to limited confidentiality and integrity impacts. The CVSS score of 4.8 (medium severity) reflects that exploitation requires high attack complexity and no privileges or user interaction, with impacts limited to partial data disclosure and modification. There is no indication of availability impact. Exploitation depends on the presence of the %%user_ip_address%% token in popup content configured by an administrator.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, administrators should avoid including the %%user_ip_address%% token in popup custom content to prevent exploitation. Monitoring for updates from the vendor and applying any released patches promptly is recommended.