PT-2025-43612 · WordPress · Popup Builder With Gamification

Rafshanzani Suhada · Published 2025-10-24 · Updated 2025-10-29 · CVE-2025-10861

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress versions prior to 2.1.5

Description The software contains a Server-Side Request Forgery issue resulting from inadequate validation of URLs provided through the URL parameter. This allows unauthenticated attackers to initiate web requests from the application to arbitrary locations. Exploitation can lead to querying and modifying internal service information, as well as network reconnaissance. A partial fix was implemented in version 2.1.4.

Recommendations Update to version 2.1.5 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-10861

Affected Products

Popup Builder With Gamification

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-10861 · Security Note
• https://twitter.com/CVEnew/status/1981687124941250664 · Twitter Post
• https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L35 · Note
• https://t.me/CVEtracker/35669 · Telegram Post
• https://twitter.com/cracbot/status/1983489038867951641 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3379308 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5f4767b5-5dd6-4a2a-b44a-5297432286b1?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3369146 · Note
• https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L15 · Note