The Popup builder plugin lacks validation on the URL parameter used in its FetchDemo route, allowing any user to direct the server to retrieve data from arbitrary URLs. This Server‑Side Request Forgery grants unauthenticated attackers the ability to query internal services, alter data, or perform network reconnaissance, potentially exposing sensitive information or enabling further attacks.

Affected products are the Popup builder with Gamification, Multi‑Step Popups, Page‑Level Targeting, and WooCommerce Triggers plugin distributed by Roxnor, all releases up to and including version 2.1.4 are vulnerable. The version 2.1.4 patch only partially mitigated the issue, meaning earlier releases remain at risk.

The CVSS score of 7.5 indicates a high severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a crafted HTTP request containing a malicious URL to the plugin’s endpoint, with no authentication required. Successful exploitation could lead to arbitrary internal data exposure or manipulation.