The roxnor Popup builder plugin for WordPress contains an SQL Injection vulnerability (CWE-89) in multiple REST API endpoints. This flaw arises from improper neutralization of special elements in SQL commands, specifically due to insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries. Unauthenticated attackers can append additional SQL queries to existing ones, potentially extracting sensitive data from the backend database. The vulnerability affects all versions up to 2.2.0. Partial remediation was introduced in version 2.2.1 addressing unauthenticated access, with a full fix for administrator-level access implemented in version 2.2.3. The CVSS 3.1 base score is 8.2, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks via the plugin's REST API endpoints, enabling unauthorized reading of sensitive database information. The integrity impact is limited (low), and availability is not affected. The vulnerability could expose confidential data stored in the WordPress database, potentially compromising user information or site configuration details.

Users should upgrade the roxnor Popup builder plugin to version 2.2.3 or later to ensure full remediation of this vulnerability for all user levels. Versions 2.2.1 and 2.2.2 provide partial fixes for unauthenticated users but do not fully address administrator-level exploitation. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the version history described in the vulnerability details.