CVE-2024-47358
📋 TL;DR
This CVE describes a missing authorization vulnerability in the Popup Maker WordPress plugin that allows attackers to access functionality not properly constrained by access control lists. Attackers can exploit this to perform actions they shouldn't have permission for. This affects all WordPress sites using Popup Maker plugin versions up to 1.19.2.
💻 Affected Systems
- Popup Maker WordPress Plugin
📦 What is this software?
Popup Maker by Code Atlantic
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify popup settings, create malicious popups, or potentially escalate privileges to gain administrative access to the WordPress site.
Likely Case
Unauthorized users can modify popup configurations, inject malicious content into popups, or disrupt site functionality by changing popup behavior.
If Mitigated
With proper access controls, only authorized administrators can modify popup settings, preventing unauthorized changes.
🎯 Exploit Status
Exploitation requires some level of access to the WordPress site, but detailed exploit techniques are not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.19.3 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/popup-maker/wordpress-popup-maker-plugin-1-19-2-broken-access-control-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Popup Maker and click 'Update Now'. 4. Alternatively, download version 1.19.3+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the Popup Maker plugin until patching is possible
Access Restriction
allImplement IP-based restrictions to WordPress admin area
🧯 If You Can't Patch
- Implement web application firewall rules to block suspicious requests to popup maker endpoints
- Enable detailed logging and monitoring for unauthorized access attempts to plugin functionality
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Popup Maker versionCheck Version:
wp plugin list --name=popup-maker --field=versionVerify Fix Applied:
Verify Popup Maker version is 1.19.3 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to /wp-admin/admin-ajax.php with popup_maker actions
- Unexpected modifications to popup settings
Network Indicators:
- Unusual traffic patterns to popup maker admin endpoints from unauthorized IPs
SIEM Query:
source="wordpress.log" AND ("popup_maker" OR "admin-ajax.php") AND status=200 AND user_role!=administrator