The Popup Builder with Gamification, Multi‑Step Popups, Page‑Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to unauthenticated SQL injection through the ‘id’ parameter. The flaw stems from insufficient escaping and the absence of prepared statements in the existing SQL query, allowing an attacker to append arbitrary SQL code. The resulting impact is the extraction of sensitive database information, as the plugin does not restrict or validate the parameter value.

The vulnerability affects the WordPress plugin developed by roxnor, known as “Popup Builder with Gamification, Multi‑Step Popups, Page‑Level Targeting, and WooCommerce Triggers.” Versions up to and including 2.1.3 are impacted; any deployment running one of these versions is susceptible.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests a low probability of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to the plugin’s endpoint; by sending a crafted ‘id’ value an unauthenticated attacker can execute arbitrary SQL commands and read database contents.