CVE-2023-36504 is a medium severity (6.5) missing authorization flaw in the BBS e-Popup WordPress plugin, versions through 2.4.5. Patchstack tracks it as broken access control. I could not confirm a fixed version, so update to the latest release or remove the plugin.
What's affected
The record says BBS e-Popup, from BBS e-Theme, is affected in versions from n/a through 2.4.5. In plain terms that means every release up to and including 2.4.5.
The record gives no fixed version. Its only reference is a Patchstack database entry, which refused an automated request when I tried to read it. So I cannot tell you which release closes the hole. Open the Patchstack entry and the plugin's page in the WordPress directory, and look at the changelog for a version after 2.4.5 that mentions access control or authorization.
If the plugin has not had a release since 2.4.5, treat it as unmaintained. Small plugins from a single developer can go quiet, and a flaw with no fix is a reason to replace the plugin.
How to check if you're exposed
WP-CLI shows the plugin version and status on any site where you have shell access.
wp plugin list --fields=name,status,version,update
wp plugin get bbs-e-popup --field=version
The plugin slug used by Patchstack is bbs-e-popup. If you do not have shell access, open Plugins in the WordPress admin and read the version under BBS e-Popup.
If you run many WordPress sites, use your management dashboard or a script that loops over them. A plugin that is installed but deactivated still sits on disk and still needs tracking, so remove unused plugins rather than just deactivating them.
Check that the version is above 2.4.5, then confirm in the changelog why.
What to do now
- Find every WordPress site that has BBS e-Popup installed, active or not.
- Update the plugin to the newest release, and read its changelog for a note on access control.
- If no release newer than 2.4.5 exists, replace the plugin with a maintained alternative that offers popups.
- Delete the plugin files from sites that do not need it.
- Review which user roles can edit site content and remove accounts that are no longer used.
- Turn on automatic updates for plugins you rely on, and review the list monthly.
Why it matters
The weakness is CWE-862, missing authorization. The plugin performs an action without checking that the person asking is allowed to do it. In WordPress, that usually means a function that handles a request but skips a capability check, so users with low privileges, or no account at all, can reach it.
The record scores it 6.5 with a network vector and no privileges, and low impact on integrity and availability. The score is medium because the flaw does not expose data and the impact is limited to changing things or disrupting the site. The record does not say exactly what the unauthorized action is.
It is not on CISA's Known Exploited Vulnerabilities list, and I found no claim of exploitation. Access control bugs are the most common issue in WordPress plugins, and they are easy to miss in review because the code works as designed for authorized users. Keeping a short list of plugins, and removing those you do not use, shrinks the surface you have to track.
Try it yourself
New plugin flaws appear all the time. This demo shows how continuous monitoring flags a component when a new advisory lands.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
I could not confirm one. The record says through 2.4.5 is affected, and Patchstack's entry was not readable. Check the plugin changelog.
Is deactivating the plugin enough?
Removing it is safer. Files that stay on disk can still be a risk, so delete plugins you do not use.
Sources
- Patchstack entry for BBS e-Popup (cited by the record; blocked to automated fetch)
- Safeguard Gold entry for CVE-2023-36504
Last reviewed: 19 October 2026.
