The plugin exposes a public REST API endpoint that accepts a user‑supplied URL and forwards it directly to WordPress network functions without any validation or restriction. This lack of protection allows an unauthenticated attacker to provoke the server to send HTTP requests to arbitrary addresses, including private internal services, potentially leaking sensitive data or enabling further compromise.

The flaw affects all releases of the WowOptin: Next‑Gen Popup Maker plugin for WordPress up to and including version 1.4.29. WordPress sites that have not upgraded beyond 1.4.29, especially those using the plugin for pop‑ups and lead generation, are therefore vulnerable.

The CVSS score of 7.2 reflects a high‑severity vulnerability. Exploitation requires only a crafted HTTP request to the public endpoint and does not require authentication. The exploitation path is therefore simple, while the potential damage includes reading or modifying internal resources. Although the EPSS score and KEV listing are unavailable, the low technical barrier and the server‑side request nature imply a moderate to high risk if left unpatched.