CVE-2025-10861: WordPress Popup Builder SSRF Vulnerability

CVE-2025-10861 Overview

CVE-2025-10861 is a Server-Side Request Forgery (SSRF) vulnerability in the Popup Builder WordPress plugin. The plugin advertises gamification, multi-step popups, page-level targeting, and WooCommerce triggers. All versions up to and including 2.1.4 fail to validate URLs supplied through the URL parameter in the FetchDemo route. Unauthenticated attackers can coerce the WordPress server into issuing arbitrary HTTP requests. The flaw is tracked under CWE-918: Server-Side Request Forgery and was only partially patched in version 2.1.4.

Critical Impact
Unauthenticated attackers can pivot through vulnerable WordPress sites to reach internal services, enumerate networks, and interact with cloud metadata endpoints.

Affected Products

Popup Builder Block plugin for WordPress, all versions through 2.1.4
WordPress installations using the affected plugin's FetchDemo route
Sites running plugin versions prior to the complete remediation in changeset 3379308

Discovery Timeline

2025-10-24 - CVE-2025-10861 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10861

Vulnerability Analysis

The vulnerability resides in the plugin's FetchDemo.php route handler, which accepts a URL parameter and issues an outbound HTTP request on behalf of the server. The route lacks scheme allow-listing, host validation, and protections against requests targeting private address space.

Because the route is reachable without authentication, any remote actor can submit crafted URLs. The server then performs the request and may return response data to the caller. This behavior enables internal service interaction, cloud metadata extraction on hosted environments, and reconnaissance of network segments otherwise unreachable from the public internet.

The vendor's 2.1.4 release only partially addressed the issue. Subsequent changeset 3379308 introduced additional restrictions, indicating that earlier fix attempts left exploitable paths.

Root Cause

The root cause is insufficient validation of user-supplied URLs before the plugin performs server-side fetches. The handler at includes/Routes/FetchDemo.php does not enforce a domain allow-list, block internal IP ranges such as 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or restrict non-HTTP schemes. See the WordPress Popup Builder source code for the affected logic.

Attack Vector

An unauthenticated attacker sends an HTTP request to the WordPress REST endpoint exposed by the plugin, supplying the URL parameter with a target of their choosing. Valid targets include http://169.254.169.254/ for cloud metadata services, http://127.0.0.1: for loopback services, and internal hostnames reachable from the WordPress host. The server proxies the request, which the attacker can use to map internal services, retrieve configuration data, or trigger state-changing requests on internal APIs.

No authentication, user interaction, or elevated privileges are required. The attack is fully remote and works over a single HTTP request.

Detection Methods for CVE-2025-10861

Indicators of Compromise

Requests to the plugin's FetchDemo REST route containing URL parameters pointing at private IP ranges, loopback, or cloud metadata endpoints
Outbound HTTP requests from the WordPress host to 169.254.169.254 or other internal addresses without a corresponding administrative action
Unusual outbound DNS lookups originating from the PHP process for internal hostnames

Detection Strategies

Inspect web server access logs for unauthenticated calls to the Popup Builder Block plugin's REST endpoints containing URL parameters
Correlate inbound REST calls with outbound HTTP traffic from the WordPress host to detect proxied requests
Flag any outbound request from the web server destined for RFC1918 ranges, link-local addresses, or cloud metadata IPs

Monitoring Recommendations

Enable egress filtering on the WordPress host and alert on blocked attempts to reach internal ranges
Forward web application logs and host network telemetry to a centralized data lake for correlation
Monitor for spikes in 4xx and 5xx responses from the plugin's REST routes that may indicate scanning behavior

How to Mitigate CVE-2025-10861

Immediate Actions Required

Update the Popup Builder Block plugin to a version newer than 2.1.4 that incorporates changeset 3379308
If an update is not immediately possible, disable the plugin until a fully patched release is verified in your environment
Audit web and application logs for prior exploitation attempts referencing the FetchDemo route

Patch Information

The vendor released two relevant fixes: WordPress Changeset #3369146 introduced the initial partial patch shipped in 2.1.4, and WordPress Changeset #3379308 added further hardening. Additional context is available in the Wordfence Vulnerability Report. Administrators should confirm the installed version includes both changesets.

Workarounds

Block unauthenticated requests to the plugin's REST routes at the web application firewall layer
Restrict outbound traffic from the WordPress host to an allow-list of required external services
Disable access to cloud instance metadata services using IMDSv2 enforcement or equivalent controls on the hosting platform

bash

# Example egress restriction using iptables to block metadata endpoint access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP