CVE-2023-0924: Zyrex Popup <= 1.0 - Admin+ Arbitrary File Upload

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-05-02 · updated 2026-06-17
Weakness: CWE-434

Description

The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install.

Affected products

ZYREX POPUP: before 1.1 — fixed in 1.1

How to fix

Upgrade to a fixed version: ZYREX POPUP 1.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/0fd0d7a5-9263-43b6-9244-7880c3d3e6f4
https://wpscan.com/vulnerability/0fd0d7a5-9263-43b6-9244-7880c3d3e6f4

Get alerted when CVE-2023-0924 or the next vulnerability affects your stack