CVE-2026-27347

Executive Summary

CVE-2026-27347 is a Missing Authorization vulnerability (CWE-862) affecting the Crocoblock JetPopup WordPress plugin through version 2.0.20.2. The flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially accessing restricted functionality or data due to inadequate authorization checks. With a CVSS score of 5.3 (Medium severity) and network-based attack vector requiring no privileges or user interaction, this vulnerability is remotely exploitable and carries confidentiality impact. At the time of this report, no patch is available from any tracked source, and no public exploit code has been identified.

Technical Analysis

The NVD description for CVE-2026-27347 identifies a Missing Authorization vulnerability — classified under CWE-862 — present in the Crocoblock JetPopup WordPress plugin. The affected version range spans from n/a (initial release) through version 2.0.20.2, indicating all releases up to and including 2.0.20.2 are vulnerable.

Vulnerability Mechanism: Missing Authorization vulnerabilities arise when an application fails to enforce proper access control checks before executing sensitive operations. In the context of a WordPress plugin such as JetPopup — which provides popup builder functionality — this flaw manifests when specific code paths, AJAX endpoints, or administrative functions are invoked without validating that the requesting user possesses the required capabilities (e.g., manage_options, edit_posts).

JetPopup, as a popup construction toolkit, exposes various REST API endpoints and admin-ajax handlers to create, modify, retrieve, and render popups. If any of these endpoints lack proper capability checks (such as current_user_can() calls in WordPress), they become accessible to unauthenticated or low-privileged users.

Attack Surface: The CVSS vector — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — confirms the following characteristics:

• Attack Vector (AV:N): The vulnerability is exploitable remotely over the network, without needing physical or local access.
• Attack Complexity (AC:L): No special conditions or race conditions are required; exploitation is straightforward.
• Privileges Required (PR:N): No authentication is needed — a completely unauthenticated attacker can exploit the flaw.
• User Interaction (UI:N): No victim interaction is necessary for successful exploitation.
• Scope (S:U): The impact is confined to the vulnerable component without affecting adjacent security boundaries.
• Confidentiality Impact (C:L): Low-level compromise of data confidentiality — the attacker can read limited sensitive information.
• Integrity Impact (I:N): No data integrity compromise.
• Availability Impact (A:N): No impact on service availability.

Specific technical details regarding the exact vulnerable function names, URL endpoints, or nonce validation failures are not disclosed in the NVD description. It is plausible that the issue relates to JetPopup's AJAX action handlers — commonly registered via wp_ajax_ and wp_ajax_nopriv_ hooks in WordPress plugins — where the nopriv variants may lack proper authorization checks. However, without explicit technical data from the vendor, these specifics remain inferred at the vulnerability-class level rather than confirmed implementation details.

Exploitation Scenarios

Prerequisite: No public PoC exists and no Nuclei template or exploit code has been identified. The following attack chain is inferred from the vulnerability class (Missing Authorization) and the CVSS vector parameters. Insufficient technical detail is available to identify the precise vulnerable endpoint.

Step 1 — Reconnaissance / Target Identification: The attacker identifies WordPress sites running the JetPopup plugin version 2.0.20.2 or earlier. This reconnaissance can be performed by:

• Scanning for the plugin's presence via HTTP response headers, HTML source comments that often include plugin names, or /wp-content/plugins/jetpopup/ directory probing.
• Using WordPress-specific scanning tools to fingerprint installed plugins and their versions by checking the readme.txt file of the plugin directory or asset version strings in enqueued scripts and stylesheets.

Step 2 — Triggering the Authorization Flaw: The attacker sends crafted HTTP requests (GET or POST) to JetPopup's exposed endpoint(s) that lack proper capability checks. Since the CVSS vector indicates no privileges required, the attacker does not need to authenticate. Requests would likely target:

• Admin-ajax handlers accessible to unauthenticated users via admin-ajax.php with specific plugin-defined actions.
• REST API routes registered by the plugin that process without permission callbacks.

Step 3 — Payload / Execution at Class Level: At the vulnerability-class level, the attacker submits specially crafted parameters via HTTP requests to invoke functionality intended for authenticated administrators. Because authorization checks are missing or incorrectly configured, these requests are processed as if originating from a legitimate privileged user. The payload consists of the specific HTTP request parameters that the vulnerable endpoint expects to perform data retrieval operations — for example, requesting a list of popup configurations, settings, or other stored data without supplying authentication credentials.

Step 4 — Post-Exploitation Impact: Upon successful exploitation, the attacker can read sensitive information exposed by the plugin. Given the CVSS confidentiality rating of LOW (C:L), the disclosed data is limited in scope. Potential impacts include:

• Exposure of popup content that may embed sensitive marketing data, internal communications, session tokens, or personal details placed within popup configurations.
• Access to plugin settings and configuration structures that could reveal infrastructure details, email addresses, or third-party API keys stored in plaintext popup templates.
• Reconnaissance value for staging further attacks against the WordPress installation.

Note: No public PoC available; attack chain is inferred from vulnerability class and CVSS parameters. The absence of integrity (I:N) and availability (A:N) impacts suggests the flaw is primarily a read-oriented information disclosure rather than an arbitrary code execution or data manipulation vector.

Impact Assessment

Business Impact: This vulnerability exposes JetPopup-powered WordPress sites to unauthenticated information disclosure. Organizations relying on JetPopup (versions ≤ 2.0.20.2) for lead capture, newsletter signup, promotional content, or user engagement face the risk of having popup-related configuration data and embedded content compromised. While the confidentiality impact is rated LOW — suggesting only limited exfiltration — the exposure could reveal:

• Customer-facing content designs and internal URL structures.
• Email addresses and API keys embedded in popup templates.
• Configuration details that aid further targeted attacks against the WordPress environment.

Affected Systems: Any WordPress installation running JetPopup version 2.0.20.2 or earlier. Because JetPopup is a widely distributed commercial plugin, the attack surface spans diverse industry verticals including e-commerce, media, SaaS, and general corporate websites.

Blast Radius and Scoring: The CVSS 3.1 base score of 5.3 (Medium) reflects the moderate maximum impact: network-accessible, low complexity, requiring no privileges or user interaction; scope unchanged with LIMITED confidentiality impact only. The exploitability metrics dominate the score — an attacker faces minimal barriers to trigger the flaw — while the security impact remains limited to low-level data exposure.

Data Confidentiality Concern: Despite the LOW confidentiality rating, the actual exposure hinges on what data JetPopup stores and renders. If the plugin retains session identifiers, administrative nonce tokens, or credentials inside popup configurations, the real-world severity may exceed the CVSS rating.

Exploitation in the Wild: No CISA KEV listing, no active exploitation evidence, and no threat actor campaigns have been identified at the time of writing. The EPSS score is not yet available from FIRST.org. However, the lack of a vendor patch combined with the plugin's wide deployment suggests exploitability could increase rapidly once technical details emerge.

Detection Guidance

The following detection rules target unauthorized access attempts to JetPopup's administrative endpoints or unusual plugin-related request patterns from unauthenticated sources.

Sigma Rule

title: Unauthenticated JetPopup Plugin Access Attempt
id: 81a4e551-8b3c-4f6e-9c2a-7d9f1e38b4c2
status: experimental
description: Detects unauthenticated HTTP requests targeting JetPopup plugin endpoints, potentially exploiting CVE-2026-27347 missing authorization vulnerability.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27347
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - '/wp-admin/admin-ajax.php'
            - 'action=jet_popup'
            - '/wp-json/jet-popup'
        c-useragent|contains:
            - 'curl'
            - 'wget'
            - 'python-requests'
    filter:
        c-uri|contains:
            - '/wp-login.php'
    condition: selection and not filter
level: medium
falsepositives:
    - Legitimate plugin functionality invoked by authenticated users
    - Automated monitoring tools accessing public endpoints
tags:
    - attack.t1190
    - cve.2026-27347
    - cwe.862

YARA Rule

rule CVE_2026_27347_JetPopup_Unauth_Access {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect HTTP requests and scripts probing for JetPopup unauthenticated endpoints (CVE-2026-27347)"
        date = "2026-02-15"
        reference = "CVE-2026-27347"
        cwe = "CWE-862"
        severity = "medium"
        license = "Threat Intelligence Report Use"

    strings:
        $s1 = "jetpopup" ascii nocase
        $s2 = "jet_popup" ascii nocase
        $s3 = "admin-ajax.php" ascii nocase
        $s4 = "wp-json/jet-popup" ascii nocase
        $s5 = "action=jet" ascii nocase
        $s6 = "readme.txt" ascii nocase
        $s7 = "Content-Type: application/json" ascii nocase
        $s8 = "2.0.20" ascii nocase

    condition:
        uint16(0) == 0x0d0a and
        any of ($s1, $s2, $s3, $s4, $s5) and
        (any of ($s6, $s7) or any of ($s8))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-27347 - Unauthenticated JetPopup Plugin Access Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action="; http_uri; content:"jet"; http_uri; pcre:"/action=(jet_popup|jetpopup)/iU"; classtype:attempted-recon; reference:cve,2026-27347; sid:20262734; rev:1;)

Elastic Detection

// Detect HTTP requests to JetPopup endpoints from unauthenticated sources (CVE-2026-27347)
network where event.category == "web" and event.dataset == "nginx.access" and
    (url.path == "/wp-admin/admin-ajax.php" or url.path startswith "/wp-json/jet-popup") and
    wildcard(url.query, "*action=jet*") and
    not user.name in ("admin", "editor", "author", "contributor", "subscriber")

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%wp-admin/admin-ajax.php%") OR like(uri_path, "%wp-json/jet-popup%")
| search uri_query="*action=jet*" OR uri_query="*jetpopup*"
| eval is_authenticated = if(like(cookie, "%wordpress_logged_in%"), "yes", "no")
| search is_authenticated="no"
| stats count by src_ip, uri, useragent, method, status
| sort - count

Wazuh OSSEC Rule

<group name="cve-2026-27347, jetpopup, wordpress,">
    <rule id="202627" level="10">
        <decoded_as>web-accesslog</decoded_as>
        <description>Unauthenticated JetPopup plugin access attempt - CVE-2026-27347</description>
        <match>admin-ajax.php</match>
        <regex>action=jet_popup|action=jetpopup|wp-json/jet-popup</regex>
        <group>web_application_attack,wordpress</group>
        <info type="cve">CVE-2026-27347</info>
        <mitre>
            <id>T1190</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (Confidence: 0/4)

There is currently no patch available for CVE-2026-27347. No vendor advisory has been issued, no fixed version has been released, and none of the four tracked patch sources contain remediation evidence. Do not wait for default auto-update mechanisms to resolve this issue.

1. Immediate Mitigations

• Disable JetPopup temporarily on production WordPress installations if the plugin is non-essential. This eliminates the attack surface entirely.
• Restrict network access to the WordPress admin area (/wp-admin/) using Web Application Firewall (WAF) rules, IP allowlists, or VPN requirements, limiting who can reach admin-ajax endpoints.
• Audit server access logs for anomalous requests to /wp-admin/admin-ajax.php or /wp-json/jet-popup endpoints originating from unfamiliar IP addresses.
• Apply virtual patching at the WAF level by blocking unauthenticated requests containing plugin-specific action parameters.
• Monitor JetPopup changelogs and vendor communications daily for patch announcements.

2. Patch/Upgrade Steps

• Upgrade to JetPopup version 2.0.21 or later once Crocoblock releases a patched version. Until then, treat all versions ≤ 2.0.20.2 as compromised.
• If upgrading is not immediately possible, remove the plugin from production and reinstall only after the vendor confirms a security fix.
• After patching, verify integrity by diffing plugin files against the official release checksums.

3. Long-Term Hardening

• Enforce the principle of least privilege by ensuring only authenticated users with specific WordPress capabilities can interact with plugin admin endpoints.
• Subscribe to WordPress plugin security advisories (e.g., WPScan, Patchstack) for active vulnerability notifications.
• Deploy a WordPress-specific WAF with rules that inspect plugin-specific REST routes and AJAX actions for missing authorization indicators.
• Implement Content Security Policy (CSP) headers and regular security audits as defense-in-depth measures.
• Maintain an up-to-date inventory of all installed WordPress plugins, their versions, and known CVEs as part of your vulnerability management program.

References

1. NVD Entry — CVE-2026-27347: https://nvd.nist.gov/vuln/detail/CVE-2026-27347
2. Crocoblock (JetPopup Vendor) — Official Site: https://crocoblock.com/plugins/jetpopup/ (monitor for security advisories and patched releases)
3. CWE-862 — Missing Authorization (MITRE): https://cwe.mitre.org/data/definitions/862.html
4. WPScan Vulnerability Database (WordPress plugin CVEs): https://wpscan.com/ (search for JetPopup after vendor disclosure)

Exploitation-in-the-Wild Evidence: As of the report date, no threat actor campaigns or active exploitation of CVE-2026-27347 have been publicly documented. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. This status may change rapidly once technical exploitation details become available, particularly given that the affected plugin version range is broad and no vendor patch exists.