CVE-2025-57931

The Popup Box plugin by Ays Pro for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) up to version 5.5.4. This is due to missing or insufficient CSRF tokens in certain requests, allowing attackers to trick authenticated users into performing unintended actions [1].

To exploit this vulnerability, an attacker must craft a malicious link or webpage that, when visited by a logged-in administrator or other privileged user, triggers unauthorized requests to the WordPress site. This can be done in a social engineering attack, often without the victim's knowledge [1].

Successful exploitation could allow the attacker to modify plugin settings, create or delete popups, or perform other actions with the privileges of the victim. This type of vulnerability is frequently used in mass-exploit campaigns targeting WordPress sites [1].

Users are advised to update the Popup Box plugin to the latest available version to mitigate this risk. If updating is not immediately possible, it is recommended to limit administrative access and avoid clicking suspicious links while logged in [1].