# CVE-2026-8848: Popup Maker authorization bypass in REST API

Source: https://junglewise.ai/threats/cve-2026-8848-popup-maker-authorization-bypass-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-8848 · Severity: high · CVSS 7.2 · Published 2026-07-09

Popup Maker is a popular WordPress plugin used to create marketing popups and opt-in forms. A security flaw allows authorized users with editor-level access to bypass security checks and install malicious software from an external source. This could allow an attacker to take full control of the website, potentially leading to data theft or a complete site shutdown.

Technologies: [Popup Maker](https://junglewise.ai/threats/technologies/popup-maker). Vendors: [Popup Maker](https://junglewise.ai/threats/vendors/popup-maker).

## Quick answers

**Is CVE-2026-8848 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8848 being exploited in the wild.

**How severe is CVE-2026-8848?** High severity, with a CVSS score of 7.2, published 9 July 2026.

**Which products and versions are affected?** Popup Maker up to, and including, 1.22.0.

**Is there a fix for CVE-2026-8848?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8848 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8848?** Check whether you run Popup Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Popup Maker plugin for WordPress (versions up to 1.22.0) contains a missing authorization check (CWE-862) in its REST API implementation. Specifically, the legacy v1/connect/info endpoint can be manipulated to issue a bearer token that satisfies the validation requirements of the install endpoint. An authenticated attacker with editor-level permissions or higher can use this token to install and activate an arbitrary plugin from a remote URL. This leads to Remote Code Execution (RCE) on the underlying server. Exploitation is contingent upon a valid Popup Maker Pro license being active on the site while the Pro version itself is not yet installed.

## Affected products

- danieliser Popup Maker up to, and including, 1.22.0

## Timeline

- 2026-07-09: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/Controllers/RestAPI.php](https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/Controllers/RestAPI.php)
- [https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/RestAPI/Connect.php](https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/RestAPI/Connect.php)
- [https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/RestAPI/Connect.php](https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/RestAPI/Connect.php)
- [https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/RestAPI/Connect.php](https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/RestAPI/Connect.php)
- [https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/Services/Connect.php](https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.21.5/classes/Services/Connect.php)
- [https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/Controllers/RestAPI.php](https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/Controllers/RestAPI.php)
- [https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/RestAPI/Connect.php](https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/RestAPI/Connect.php)

## Related threats

- [Popup Maker WordPress plugin authorization bypass in account connection](https://junglewise.ai/threats/cve-2026-85004-the-popup-maker-wordpress-plugin-through-1-4-5-does-not-perform-a)
- [Popup Maker stored cross-site scripting in post title](https://junglewise.ai/threats/cve-2026-15797-popup-maker-stored-cross-site-scripting-in-post-title)