CVE-2026-8848 is an authorization bypass vulnerability (CWE-862) in the Popup Maker plugin for WordPress by danieliser, affecting all versions up to and including 1.22.0. The plugin fails to properly verify user authorization, enabling authenticated users with editor-level privileges or higher to install and activate arbitrary plugins from attacker-controlled URLs. Successful exploitation depends on the presence of a valid Popup Maker Pro license and the absence of the Pro plugin installation, as these conditions allow the legacy v1/connect/info endpoint to issue a bearer token required for the install endpoint's validation. This vulnerability can lead to remote code execution on the target system.

An attacker with editor-level or higher privileges can bypass authorization controls to install and activate arbitrary plugins, potentially achieving remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site. Exploitation requires specific conditions related to the Popup Maker Pro license and installation state, limiting the attack surface but still posing a significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level access to trusted users only and monitor for suspicious plugin installations. Verify the presence and status of Popup Maker Pro licenses and installations to assess exposure. Follow vendor advisories for updates on patches or official mitigations.