HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.13 - Unauthenticated Insecure Direct Object Reference to Arbitrary Post Unpublishing via Popup REST Endpoints
- ID
- WPSEC-2026-0577
- Plugin
- HollerBox — Fast & Effective Popups & Lead-Generation (holler-box)
- Affected
- from 2.0 before 2.3.15
- Remediation
- Update to 2.3.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-07
- Attack surface
- HollerBox — Fast & Effective Popups & Lead-Generation on WPSec AttackSurface
- Fix released
- Published
Description
The HollerBox plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0 up to, and including, 2.3.13. The public popup submission, impression and conversion REST endpoints load a popup from a user-supplied ID without checking that the post is a HollerBox popup, and loading a popup runs a legacy settings migration that saves changes to that post. This makes it possible for unauthenticated attackers to change the status of arbitrary posts, pages and other content to draft, taking them off the site, and to write HollerBox settings into their post meta. The submission endpoint also accepted submissions to unpublished popups, running their configured integrations.
References
- https://wpsec.com/vuln/WPSEC-2026-0577/
- https://plugins.svn.wordpress.org/holler-box/tags/2.3.15/
- https://wordpress.org/plugins/holler-box/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS