The kamleshyadav Exit Intent Popup plugin, versions up to 1.0.1, contains a Server-Side Request Forgery (SSRF) vulnerability. SSRF vulnerabilities enable attackers to make the server perform unauthorized requests, which can lead to information disclosure or manipulation of server-side data. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, with impacts limited to confidentiality and integrity but not availability. No patch or official fix has been documented at this time.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the affected server to send crafted requests to internal or external resources, potentially exposing sensitive information or altering data integrity. The impact is limited to confidentiality and integrity, with no direct availability impact reported. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the use of the Exit Intent Popup plugin to trusted environments only. Monitor vendor channels for updates and apply patches promptly once available.