The Popup Box plugin for WordPress suffers from a CSRF vulnerability due to improper nonce validation in the 'publish_unpublish_popupbox' function. Instead of verifying the nonce provided by the user request, the function verifies a nonce it creates itself, which fails to protect against forged requests. This vulnerability enables unauthenticated attackers to alter the publish status of popups by convincing an administrator to perform an action such as clicking a crafted link. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker can change the publish status of popups without authentication by exploiting the CSRF vulnerability, potentially affecting the content displayed on the site. The impact is limited to integrity (modification of popup publish status) with no confidentiality or availability impact reported. The attack requires user interaction from an administrator, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor is recommended to apply any official fixes once released.