CVE-2026-106603

Executive Summary

CVE-2026-106603 is an authorization bypass vulnerability in the Groundhogg HollerBox WordPress plugin, affecting all versions up to and including 2.3.14. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning an attacker can manipulate a key value to access resources or perform actions they are not authorized to perform. With a CVSS score of 6.5, exploitation requires no authentication or user interaction, but impact is limited to integrity and availability with no direct confidentiality loss.

Technical Analysis

The vulnerability resides in the HollerBox plugin for WordPress, a tool used to create promotional popups, opt-in forms, and notification bars. The core issue is an authorization bypass through user-controlled key (CWE-639). In this class of vulnerability, the application relies on a user-supplied identifier—such as an object ID, a nonce, or a parameter value—to determine whether an action is permitted, without properly validating that the requesting user has the right to perform that action on the referenced object.

According to the NVD description, the vulnerability allows "Exploiting Incorrectly Configured Access Control Security Levels." This indicates that access control checks are either missing or improperly implemented on one or more plugin endpoints. An unauthenticated attacker can supply a crafted key value that bypasses the intended authorization logic, thereby interacting with functionality or data that should be restricted.

The attack surface is the WordPress REST API or admin-ajax.php endpoints exposed by the HollerBox plugin. Because the CVSS vector specifies PR:N (no privileges required) and UI:N (no user interaction), the vulnerable endpoint is reachable by any network-accessible client without prior authentication. The scope is unchanged (S:U), and the impact is confined to low integrity and low availability effects, suggesting the bypass enables modification or disruption of plugin-managed resources rather than full site takeover or data exfiltration.

No specific function names, endpoint paths, or parameter names are provided in the available intelligence. The technical mechanics are therefore described at the vulnerability-class level: a user-controlled key is trusted for authorization decisions, enabling an attacker to reference objects or invoke actions outside their privilege set. The plugin’s popup and form management features—likely involving creation, modification, or deletion of campaign data—represent the probable target of the bypass.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-106603. The attack chain is inferred from the vulnerability class (CWE-639) and the CVSS vector.

1. Reconnaissance and target identification: An attacker scans for WordPress sites with the HollerBox plugin installed. This can be done via Shodan dorks (e.g., http.html:"hollerbox") or by enumerating plugin assets on candidate sites. The attacker identifies a target running HollerBox version 2.3.14 or earlier.

2. Triggering the flaw class: The attacker identifies a plugin endpoint that accepts a user-controlled key—such as an object identifier or a nonce—used for authorization. Because the access control check is incorrectly configured, the attacker can supply a key value that references a resource they do not own or should not access.

3. Payload/execution method: At the vulnerability-class level, the attacker crafts an HTTP request to the vulnerable endpoint, substituting the user-controlled key with a value that bypasses the authorization logic. This could allow the attacker to modify plugin settings, create or alter popup campaigns, or otherwise manipulate HollerBox-managed data. No specific payload syntax can be provided without further technical detail.

4. Post-exploitation impact: Successful exploitation yields low integrity and availability impact. The attacker may deface or alter promotional content, inject unwanted redirects or forms, or disrupt the availability of popups and notifications. Confidentiality is not directly impacted according to the CVSS vector, though secondary effects (e.g., using modified forms for phishing) are possible. The scope remains unchanged, meaning the compromise is confined to the plugin’s functionality and does not directly pivot to the underlying WordPress core or server.

Impact Assessment

The CVSS 3.1 base score is 6.5 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. This translates to:

• Attack Vector (Network): Exploitable remotely over the internet.
• Attack Complexity (Low): No special conditions or race conditions required.
• Privileges Required (None): The attacker does not need an account on the target site.
• User Interaction (None): No victim action is needed.
• Scope (Unchanged): The impact is confined to the vulnerable component.
• Confidentiality (None): No direct data disclosure.
• Integrity (Low): Limited ability to modify data or behavior.
• Availability (Low): Limited ability to disrupt service.

Business impact includes reputational damage from defaced popups or malicious forms, potential phishing campaigns hosted on the trusted domain, and disruption of marketing or lead-generation workflows. The blast radius is limited to sites running the vulnerable HollerBox plugin; however, because the plugin is widely used for front-end engagement, any successful exploit is publicly visible to site visitors. There is no evidence of active exploitation in the wild, and the CVE is not listed in CISA KEV. The EPSS score is not yet available from FIRST.org.

Detection Guidance

Sigma Rule

title: Groundhogg HollerBox Authorization Bypass Attempt (CVE-2026-106603)
id: 8f4c2e1a-9b3d-4f7e-a1c2-5d6e7f8a9b0c
status: experimental
description: Detects attempts to exploit CWE-639 authorization bypass in HollerBox plugin via user-controlled key manipulation.
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - POST
      - GET
  selection_uri:
    cs-uri-query|contains:
      - 'hollerbox'
      - 'holler-box'
  selection_params:
    cs-uri-query|contains:
      - 'id='
      - 'key='
      - 'nonce='
      - 'campaign='
  condition: selection_method and selection_uri and selection_params
falsepositives:
  - Legitimate plugin administration traffic with valid keys.
level: medium
tags:
  - attack.t1190
  - cve.2026.106603

YARA Rule

rule CVE_2026_106603_HollerBox_AuthBypass
{
    meta:
        description = "Detects HollerBox plugin files vulnerable to CVE-2026-106603"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106603"
        severity = "medium"
    strings:
        $plugin_name = "hollerbox" nocase
        $plugin_slug = "holler-box" nocase
        $version = /Version:\s*2\.3\.(0|1[0-4])/
    condition:
        any of ($plugin_name, $plugin_slug) and $version
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106603 Groundhogg HollerBox Authorization Bypass Attempt"; flow:to_server,established; content:"hollerbox"; http_uri; nocase; content:"id="; http_uri; nocase; content:"key="; http_uri; nocase; classtype:attempted-admin; sid:2026106603; rev:1; reference:cve,2026-106603; metadata:service http;)

Elastic Detection

network where
  http.request.method in ("GET", "POST") and
  stringContains(http.request.uri, "hollerbox") and
  (stringContains(http.request.uri, "key=") or stringContains(http.request.uri, "id=") or stringContains(http.request.uri, "nonce="))

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| search uri_path="*hollerbox*" OR uri_query="*holler-box*"
| search uri_query="*key=*" OR uri_query="*id=*" OR uri_query="*nonce=*"
| stats count by src_ip, uri_path, uri_query, status
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100603" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>hollerbox|holler-box</url>
    <regex>key=|id=|nonce=</regex>
    <description>CVE-2026-106603: Groundhogg HollerBox authorization bypass attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106603,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source.

1. Immediate mitigations:

   • Disable or deactivate the HollerBox plugin until a patched version is available.
   • If the plugin must remain active, restrict access to its administrative endpoints via web application firewall (WAF) rules that block requests containing user-controlled keys without proper authorization tokens.
   • Implement virtual patching through a WAF to validate that requests to HollerBox endpoints originate from authenticated users with appropriate capabilities.

2. Patch/upgrade steps:

   • No vendor patch is currently available (affected through 2.3.14). Monitor the Groundhogg HollerBox plugin repository and vendor channels for an updated release.
   • Once a patched version is published, upgrade immediately and verify that the authorization logic properly validates user-controlled keys against the authenticated user’s permissions.

3. Long-term hardening:

   • Audit all WordPress plugins for similar CWE-639 patterns, especially those that rely on client-supplied identifiers for access control decisions.
   • Enforce least-privilege principles and capability checks (e.g., WordPress current_user_can()) on all plugin endpoints.
   • Regularly scan for plugin vulnerabilities and maintain an inventory of installed plugins and versions.
   • Consider using a WordPress security plugin that provides virtual patching and vulnerability scanning for unpatched components.

References

• NVD – CVE-2026-106603: https://nvd.nist.gov/vuln/detail/CVE-2026-106603
• CWE-639: Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 – Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Groundhogg HollerBox plugin (WordPress.org): https://wordpress.org/plugins/holler-box/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed as of report date)