CVE-2025-10861: WordPress Popup Builder SSRF Vulnerability

CVE-2025-10861 Overview

CVE-2025-10861 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Popup Builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress in all versions up to and including 2.1.4. The vulnerability exists due to insufficient validation on URLs supplied via the URL parameter, allowing unauthenticated attackers to make web requests to arbitrary locations originating from the vulnerable web application.

This SSRF vulnerability can be leveraged to query and modify information from internal services, conduct network reconnaissance, and potentially pivot to attack internal infrastructure that would otherwise be inaccessible from the internet.

Critical Impact

Unauthenticated attackers can exploit this SSRF to access internal services, perform network reconnaissance, and potentially exfiltrate sensitive data from protected backend systems.

Affected Products

• Popup Builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress versions ≤ 2.1.4
• WordPress sites utilizing the popup-builder-block plugin
• Installations with the vulnerable FetchDemo.php route handler

Discovery Timeline

• 2025-10-24 - CVE CVE-2025-10861 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10861

Vulnerability Analysis

This Server-Side Request Forgery vulnerability stems from the plugin's failure to properly validate user-supplied URLs before making server-side HTTP requests. The vulnerable code is located in the FetchDemo.php file within the plugin's Routes directory, specifically at lines 15 and 35.

When the application processes a URL parameter without proper validation, an attacker can supply arbitrary URLs including internal network addresses (127.0.0.1, localhost, 192.168.x.x, 10.x.x.x, etc.), cloud metadata endpoints (169.254.169.254), or other internal services. The server then makes requests to these locations on behalf of the attacker, effectively bypassing network security controls.

Root Cause

The root cause of CVE-2025-10861 is insufficient input validation in the URL parameter handling within the FetchDemo.php route handler. The plugin accepts URLs from user input without implementing proper allowlist validation, URL scheme restrictions, or checks to prevent requests to internal network ranges. This violates the principle of input validation and allows the server to be weaponized as a proxy for attacking internal infrastructure.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An unauthenticated attacker can craft malicious HTTP requests containing specially crafted URL parameters targeting the vulnerable endpoint. The exploitation flow involves:

1. Identifying a WordPress site running a vulnerable version of the Popup Builder plugin
2. Crafting a request to the FetchDemo endpoint with a malicious URL parameter
3. Specifying internal network addresses, cloud metadata endpoints, or other sensitive targets
4. Receiving the server's response containing data from the internal target

The vulnerability allows attackers to access internal services such as database servers, internal APIs, cloud instance metadata services, and other backend infrastructure that would typically be protected by network segmentation.

Detection Methods for CVE-2025-10861

Indicators of Compromise

• Unexpected outbound HTTP requests from the WordPress server to internal IP ranges (127.0.0.1, 10.x.x.x, 172.16.x.x, 192.168.x.x)
• HTTP requests to cloud metadata endpoints (169.254.169.254) originating from the web server
• Access logs showing requests to the FetchDemo.php endpoint with unusual URL parameters
• Network traffic to internal services from the WordPress application server

Detection Strategies

• Monitor web application logs for requests to /wp-content/plugins/popup-builder-block/ paths containing URL parameters with internal IP addresses
• Implement network-level detection for outbound connections from web servers to internal infrastructure or metadata endpoints
• Deploy Web Application Firewall (WAF) rules to detect and block SSRF patterns in URL parameters
• Use SentinelOne Singularity to detect anomalous network behavior from web application processes

Monitoring Recommendations

• Enable verbose logging on the WordPress site and monitor for suspicious plugin activity
• Configure network monitoring to alert on web server connections to RFC 1918 private address spaces
• Set up alerting for any requests to cloud provider metadata endpoints from application servers
• Review firewall logs for unusual egress traffic patterns from WordPress hosting infrastructure

How to Mitigate CVE-2025-10861

Immediate Actions Required

• Update the Popup Builder plugin to the latest available version (note: version 2.1.4 contains only a partial patch)
• If update is not immediately possible, disable the Popup Builder plugin until a complete fix is available
• Implement WAF rules to block SSRF attack patterns targeting the vulnerable endpoint
• Review network architecture to ensure web servers cannot access sensitive internal services

Patch Information

The vulnerability was partially patched in version 2.1.4 of the Popup Builder plugin. Patches are documented in WordPress Changeset #3369146 and WordPress Changeset #3379308. Administrators should monitor for additional updates that provide a complete fix and apply them as soon as available. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

• Block access to the vulnerable FetchDemo.php endpoint at the web server or WAF level
• Implement network segmentation to prevent the WordPress server from accessing sensitive internal services
• Configure egress filtering to restrict the web server's ability to make outbound connections to internal IP ranges
• Deploy reverse proxy or WAF rules to validate and sanitize URL parameters before they reach the application

# Apache .htaccess example to block access to vulnerable endpoint
<Files "FetchDemo.php">
    Order Allow,Deny
    Deny from all
</Files>

# Nginx configuration to block the vulnerable route
location ~* /wp-content/plugins/popup-builder-block/includes/Routes/FetchDemo\.php {
    deny all;
    return 403;
}