This vulnerability exists in the kamleshyadav Exit Intent Popup plugin (version <= 1.0.1) and allows an attacker to perform Server-Side Request Forgery (SSRF). SSRF vulnerabilities enable attackers to make the server send crafted requests to internal or external resources, potentially bypassing access controls. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, with partial impact on confidentiality and integrity but no impact on availability.

An attacker exploiting this SSRF vulnerability could cause the affected server to send unauthorized requests, potentially leading to information disclosure or modification of data accessible by the server. The impact is limited to partial confidentiality and integrity loss, with no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and apply any released patches promptly. Until a fix is available, consider restricting server outbound requests or implementing network-level controls to limit SSRF attack vectors.