Popup Box WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Popup Box plugin for WordPress, affecting all versions through 6.1.1. The issue arises from a nonce verification flaw in the 'publish_unpublish_popupbox' function, which incorrectly validates a self-generated nonce instead of one provided in the request. This vulnerability allows unauthenticated attackers to manipulate the publish status of popups by sending a forged request, provided they can deceive a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for unauthorized changes to the publish status of popups, potentially leading to unwanted content visibility or engagement on the site.

Reproduction

To reproduce this vulnerability, an attacker must craft a request that includes a forged nonce, bypassing the plugin's nonce verification. This can be done by tricking an administrator into clicking a link that triggers the request, such as through a phishing email or a compromised website.

Remediation

Users are advised to update the Popup Box plugin to version 6.1.2 or later, where this vulnerability has been patched.