The Exit Intent Popup plugin contains a Server Side Request Forgery flaw that permits attackers to manipulate the plugin’s request handling logic to trigger HTTP requests to arbitrary URLs. An attacker could use this capability to reach internal addresses, read sensitive data, or perform denial‑of‑service actions against external services. The weakness is identified as CWE‑918.

The vulnerability affects the kamleshyadav Exit Intent Popup WordPress plugin for versions up to and including 1.0.1. Any WordPress installation that loads this plugin in those versions is susceptible, regardless of the specific WordPress core version.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is less than 1 %, suggesting a low probability of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated web request to the plugin’s exposed endpoint, requiring the site to be reachable by an external attacker. Successful exploitation would enable the attacker to initiate outbound connections from the vulnerable server.