PT-2026-26795 · WordPress · Wowoptin: Next-Gen Popup Maker

Itthidej Aramsri

·

Published

2026-03-21

·

Updated

2026-03-21

·

CVE-2026-4302

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions WowOptin: Next-Gen Popup Maker plugin for WordPress versions through 1.4.29
Description The WowOptin: Next-Gen Popup Maker plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF). This is caused by a publicly accessible REST API endpoint, /optn/v1/integration-action, utilizing a permission callback of return true. The plugin passes user-supplied URLs directly to the functions wp remote get() and wp remote post() within the Webhook::add subscriber() method without validating or restricting the URLs. The plugin does not employ wp safe remote get() or wp safe remote post(), which offer built-in SSRF protection. This allows unauthenticated attackers to make web requests to arbitrary locations from the web application, potentially enabling them to query and modify information from internal services.
Recommendations Versions prior to 1.4.29 should be updated. As a temporary workaround, restrict access to the /optn/v1/integration-action API endpoint.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-4302

Affected Products

Wowoptin: Next-Gen Popup Maker