CVE-2026-3475 PUBLISHED

Instant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter

Assigner: Wordfence
Reserved: 03.03.2026 Published: 19.03.2026 Updated: 19.03.2026

The Instant Popup Builder plugin for WordPress is vulnerable to Unauthenticated Arbitrary Shortcode Execution in all versions up to and including 1.1.7. This is due to the handle_email_verification_page() function constructing a shortcode string from user-supplied GET parameters (token, email) and passing it to do_shortcode() without properly sanitizing square bracket characters, combined with missing authorization checks on the init hook. While sanitize_text_field() and esc_attr() are applied, neither function strips or escapes square bracket characters ([ and ]). WordPress's shortcode regex uses [^]\/]* to match content inside shortcode tags, meaning a ] character in the token value prematurely closes the shortcode tag. This makes it possible for unauthenticated attackers to inject and execute arbitrary registered shortcodes by crafting a malicious token parameter containing ] followed by arbitrary shortcode syntax.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 5.3

Product Status

Vendor instantpopupbuilder
Product Instant Popup Builder – Powerful Popup Maker for Opt-ins, Email Newsletters & Lead Generation
Versions Default: unaffected
  • affected from * to 1.1.7 (incl.)

Credits

  • Youcef Hamdani finder

References

Problem Types

  • CWE-862 Missing Authorization CWE