CVE-2025-10861

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10861", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-22T22:56:11.517Z", "datePublished": "2025-10-24T11:25:45.885Z", "dateUpdated": "2026-04-08T16:56:20.864Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:20.864Z"}, "affected": [{"vendor": "roxnor", "product": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4."}], "title": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4767b5-5dd6-4a2a-b44a-5297432286b1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L35"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L15"}, {"url": "https://plugins.trac.wordpress.org/changeset/3369146/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3379308/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-09-22T23:31:57.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-23T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-24T12:18:58.704704Z", "id": "CVE-2025-10861", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T12:29:54.990Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10861", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-24T12:18:58.704704Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T12:18:59.740Z"}}], "cna": {"title": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "roxnor", "product": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-22T23:31:57.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-23T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4767b5-5dd6-4a2a-b44a-5297432286b1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L35"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L15"}, {"url": "https://plugins.trac.wordpress.org/changeset/3369146/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3379308/"}], "descriptions": [{"lang": "en", "value": "The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:20.864Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10861", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:56:20.864Z", "dateReserved": "2025-09-22T22:56:11.517Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-24T11:25:45.885Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers", "vendor": "roxnor", "versions": [{"lessThanOrEqual": "2.1.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4."}, {"lang": "es", "value": "El plugin Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta, e incluyendo, la 2.1.4. Esto se debe a una validaci\u00f3n insuficiente en las URL proporcionadas a trav\u00e9s del par\u00e1metro URL. Esto hace posible que atacantes no autenticados realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede usarse para consultar y modificar informaci\u00f3n de servicios internos, as\u00ed como para realizar reconocimiento de red. La vulnerabilidad fue parcialmente parcheada en la versi\u00f3n 2.1.4."}], "id": "CVE-2025-10861", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10861", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-24T12:18:58.704704Z", "version": "2.0.3"}}]}, "published": "2025-10-24T12:15:37.340", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L15"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L35"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3369146/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3379308/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4767b5-5dd6-4a2a-b44a-5297432286b1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:59:41.005302+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to the latest released version (2.1.5 or newer) that fully resolves the vulnerability.", "If an upgrade is not immediately possible, alter the plugin\u2019s code to disable the FetchDemo route or enforce authentication and validate the URL parameter against a whitelist.", "Deploy a web application firewall rule to block requests to the vulnerable endpoint or restrict outbound connections from the WordPress instance."], "summary": {"action": "Immediate Patch", "impact": "Server-Side Request Forgery"}, "threat_synthesis": {"affected_systems": "Affected products are the Popup builder with Gamification, Multi\u2011Step Popups, Page\u2011Level Targeting, and WooCommerce Triggers plugin distributed by Roxnor, all releases up to and including version 2.1.4 are vulnerable. The version 2.1.4 patch only partially mitigated the issue, meaning earlier releases remain at risk.", "description_and_impact": "The Popup builder plugin lacks validation on the URL parameter used in its FetchDemo route, allowing any user to direct the server to retrieve data from arbitrary URLs. This Server\u2011Side Request Forgery grants unauthenticated attackers the ability to query internal services, alter data, or perform network reconnaissance, potentially exposing sensitive information or enabling further attacks.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a crafted HTTP request containing a malicious URL to the plugin\u2019s endpoint, with no authentication required. Successful exploitation could lead to arbitrary internal data exposure or manipulation."}}}}, "created": "2025-10-27T22:12:56.545236+00:00", "updated": "2026-04-22T13:00:09.746317+00:00", "vendors": ["popup_builder", "popup_builder$PRODUCT$popup_builder", "roxnor", "roxnor$PRODUCT$popup_builder", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}