CVE-2025-10861

Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery

View on CVE.org

Published Oct 24, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4.

Analysis

Technical impact

The Popup builder plugin lacks validation on the URL parameter used in its FetchDemo route, allowing any user to direct the server to retrieve data from arbitrary URLs. This Server‑Side Request Forgery grants unauthenticated attackers the ability to query internal services, alter data, or perform network reconnaissance, potentially exposing sensitive information or enabling further attacks.

Affected Systems

Affected products are the Popup builder with Gamification, Multi‑Step Popups, Page‑Level Targeting, and WooCommerce Triggers plugin distributed by Roxnor, all releases up to and including version 2.1.4 are vulnerable. The version 2.1.4 patch only partially mitigated the issue, meaning earlier releases remain at risk.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a crafted HTTP request containing a malicious URL to the plugin’s endpoint, with no authentication required. Successful exploitation could lead to arbitrary internal data exposure or manipulation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

roxnor

Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.1.4

No data.

Vendor	Product	Versions
Popup Builder	Popup Builder	—
Roxnor	Popup Builder	—
Woocommerce	Woocommerce	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the plugin to the latest released version (2.1.5 or newer) that fully resolves the vulnerability.
If an upgrade is not immediately possible, alter the plugin’s code to disable the FetchDemo route or enforce authentication and validate the URL parameter against a whitelist.
Deploy a web application firewall rule to block requests to the vulnerable endpoint or restrict outbound connections from the WordPress instance.

Generated by OpenCVE AI on April 22, 2026 at 12:59 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.384% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L15
https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L35
https://plugins.trac.wordpress.org/changeset/3369146/
https://plugins.trac.wordpress.org/changeset/3379308/
https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4767b5-5dd6-4a2a-b44a-5297432286b1?source=cve

History

Oct 27, 2025 10:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Popup Builder Popup Builder popup Builder Roxnor Roxnor popup Builder Woocommerce Woocommerce woocommerce Wordpress Wordpress wordpress
Vendors & Products		Popup Builder Popup Builder popup Builder Roxnor Roxnor popup Builder Woocommerce Woocommerce woocommerce Wordpress Wordpress wordpress

Oct 24, 2025 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 24, 2025 11:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4.
Title		Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery
Weaknesses		CWE-918
References		https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L15 https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L35 https://plugins.trac.wordpress.org/changeset/3369146/ https://plugins.trac.wordpress.org/changeset/3379308/ https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4767b5-5dd6-4a2a-b44a-5297432286b1?source=cve
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`