Server-Side Request Forgery in Popup Builder for WordPress

CVE-2025-10861

What is CVE-2025-10861?

The Popup Builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is exploitable through Server-Side Request Forgery due to insufficient URL validation. This allows unauthenticated attackers to issue web requests to unauthorized locations, potentially allowing information retrieval and modification from internal services, as well as the ability to conduct network reconnaissance activities. While a partial patch was introduced in version 2.1.4, users of the affected versions should remain vigilant and apply all recommended security measures.

References