CVE-2025-10862

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10862", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-22T22:58:28.462Z", "datePublished": "2025-10-09T08:23:17.221Z", "dateUpdated": "2026-04-08T17:09:46.727Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:46.727Z"}, "affected": [{"vendor": "roxnor", "product": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93e0a1a1-fba6-4209-b679-e66d77870be2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/Popup.php#L232"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Helpers/DataBase.php#L374"}, {"url": "https://plugins.trac.wordpress.org/changeset/3369146/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-09-22T23:31:44.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-08T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-09T14:58:07.905849Z", "id": "CVE-2025-10862", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T15:06:58.535Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10862", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-09T14:58:07.905849Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T15:05:09.170Z"}}], "cna": {"title": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "roxnor", "product": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-22T23:31:44.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-08T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93e0a1a1-fba6-4209-b679-e66d77870be2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/Popup.php#L232"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Helpers/DataBase.php#L374"}, {"url": "https://plugins.trac.wordpress.org/changeset/3369146/"}], "descriptions": [{"lang": "en", "value": "The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:46.727Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10862", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:09:46.727Z", "dateReserved": "2025-09-22T22:58:28.462Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-09T08:23:17.221Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers", "vendor": "roxnor", "versions": [{"lessThanOrEqual": "2.1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin 'Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers' para WordPress es vulnerable a inyecci\u00f3n SQL en todas las versiones hasta la 2.1.3, inclusive. Esto se debe a un escape insuficiente en el par\u00e1metro 'id' y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto permite que atacantes no autenticados a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-10862", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10862", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-09T14:58:07.905849Z", "version": "2.0.3"}}]}, "published": "2025-10-09T09:15:45.080", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Helpers/DataBase.php#L374"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/Popup.php#L232"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3369146/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93e0a1a1-fba6-4209-b679-e66d77870be2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:12:14.884630+00:00", "value": {"mitigation_remediation": ["Upgrade the Popup Builder plugin to a version newer than 2.1.3", "If an immediate upgrade is not possible, restrict access to the plug\u2011in\u2019s \u2018id\u2019 parameter by blocking or validating incoming requests through a web application firewall", "Ensure that the WordPress installation and all other plugins are kept current to reduce the overall attack surface"], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated SQL Injection leading to information disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress plugin developed by roxnor, known as \u201cPopup Builder with Gamification, Multi\u2011Step Popups, Page\u2011Level Targeting, and WooCommerce Triggers.\u201d Versions up to and including 2.1.3 are impacted; any deployment running one of these versions is susceptible.", "description_and_impact": "The Popup Builder with Gamification, Multi\u2011Step Popups, Page\u2011Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to unauthenticated SQL injection through the \u2018id\u2019 parameter. The flaw stems from insufficient escaping and the absence of prepared statements in the existing SQL query, allowing an attacker to append arbitrary SQL code. The resulting impact is the extraction of sensitive database information, as the plugin does not restrict or validate the parameter value.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests a low probability of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to the plugin\u2019s endpoint; by sending a crafted \u2018id\u2019 value an unauthenticated attacker can execute arbitrary SQL commands and read database contents."}}}}, "created": "2025-10-09T12:51:13.225126+00:00", "updated": "2026-04-22T13:15:17.849998+00:00", "vendors": ["roxnor", "roxnor$PRODUCT$popup_builder", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}