CVE-2026-8848 is an authorization bypass vulnerability (CWE-862) in the Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder WordPress plugin by danieliser. The plugin fails to properly verify user authorization for certain actions, allowing authenticated users with editor or higher privileges to install and activate arbitrary plugins from attacker-controlled URLs. Successful exploitation requires a valid Popup Maker Pro license and that the Pro plugin is not installed, as these conditions enable the legacy v1/connect/info endpoint to issue a bearer token necessary for the install endpoint's validation. This vulnerability affects all versions up to and including 1.22.0 and can lead to remote code execution.

An attacker with editor-level or higher privileges can bypass authorization controls to install and activate arbitrary plugins, resulting in remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site. The attack requires specific conditions related to the Popup Maker Pro license and installation status, limiting but not eliminating the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict editor-level access to trusted users only and monitor for suspicious activity related to plugin installation. Verify the presence and status of Popup Maker Pro license and plugin installation as part of risk assessment.