CVE-2025-10861: CWE-918 Server-Side Request Forgery (SSRF) in roxnor Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4.
AI Analysis
Technical Summary
CVE-2025-10861 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the roxnor Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers WordPress plugin. The vulnerability affects all versions up to and including 2.1.4 due to insufficient validation of URLs passed via a URL parameter. This flaw allows unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations, potentially exposing internal services and enabling network reconnaissance. The vulnerability was partially addressed in version 2.1.4, but no complete patch or remediation details are provided in the available data.
Potential Impact
An unauthenticated attacker can exploit this SSRF vulnerability to make the affected server perform arbitrary HTTP requests. This can lead to unauthorized querying and modification of internal services and facilitate network reconnaissance. The CVSS score of 7.5 indicates a high impact on confidentiality, with no direct impact on integrity or availability reported.
Mitigation Recommendations
The vulnerability was partially patched in version 2.1.4 of the plugin. However, no definitive patch or full remediation status is confirmed from the available data. Users should upgrade to at least version 2.1.4 to benefit from partial mitigation and monitor the vendor's advisory for any further updates or official fixes. Until a full patch is available, consider restricting access to the plugin's functionality or implementing network-level controls to limit the server's ability to make arbitrary outbound requests.
CVE-2025-10861: CWE-918 Server-Side Request Forgery (SSRF) in roxnor Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
Description
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-10861 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the roxnor Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers WordPress plugin. The vulnerability affects all versions up to and including 2.1.4 due to insufficient validation of URLs passed via a URL parameter. This flaw allows unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations, potentially exposing internal services and enabling network reconnaissance. The vulnerability was partially addressed in version 2.1.4, but no complete patch or remediation details are provided in the available data.
Potential Impact
An unauthenticated attacker can exploit this SSRF vulnerability to make the affected server perform arbitrary HTTP requests. This can lead to unauthorized querying and modification of internal services and facilitate network reconnaissance. The CVSS score of 7.5 indicates a high impact on confidentiality, with no direct impact on integrity or availability reported.
Mitigation Recommendations
The vulnerability was partially patched in version 2.1.4 of the plugin. However, no definitive patch or full remediation status is confirmed from the available data. Users should upgrade to at least version 2.1.4 to benefit from partial mitigation and monitor the vendor's advisory for any further updates or official fixes. Until a full patch is available, consider restricting access to the plugin's functionality or implementing network-level controls to limit the server's ability to make arbitrary outbound requests.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-09-22T22:56:11.517Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 68fb65c0e72abe4943328fa0
Added to database: 10/24/2025, 11:40:48 AM
Last enriched: 4/9/2026, 3:50:27 PM
Last updated: 5/10/2026, 5:33:35 AM
Views: 271
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.