The Popup builder with Gamification plugin for WordPress is vulnerable to generic SQL Injection due to insufficient escaping on user supplied parameters in numerous REST API endpoints. The flaw permits unauthenticated attackers to append malicious SQL statements to existing queries, enabling extraction of sensitive database content. This weakness is a classic SQL Injection scenario (CWE-89).

Vulnerable versions are all releases up to and including 2.2.0 of the Popup builder with Gamification, Multi‑Step Popups, Page‑Level Targeting, and WooCommerce Triggers plugin. Administrators can be affected in earlier releases; the issue was fully resolved in version 2.2.3, while unauthenticated users received an initial fix in 2.2.1.

The CVSS score of 8.2 indicates a high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation as of the latest data. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via any unauthenticated user who can access the plugin’s REST API; no additional prerequisites are stated explicitly in the CVE description. Because the flaw allows arbitrary SQL to be injected and executed, the impact could range from data confidentiality loss to broader compromise if database credentials are exposed.