CVE-2025-10862: WordPress Popup Builder SQLi Vulnerability

CVE-2025-10862 Overview

A SQL Injection vulnerability exists in the Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress in all versions up to and including 2.1.3. The vulnerability stems from insufficient escaping on the id parameter and lack of sufficient preparation on existing SQL queries, allowing unauthenticated attackers to append additional SQL queries that can extract sensitive information from the database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive information from the WordPress database, including user credentials, configuration data, and other confidential information stored within the site.

Affected Products

• Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress versions up to and including 2.1.3
• WordPress sites running the popup-builder-block plugin
• WooCommerce-integrated WordPress installations using the affected plugin

Discovery Timeline

• 2025-10-09 - CVE-2025-10862 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10862

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the WordPress Popup Builder plugin through improper handling of the id parameter in database queries. The vulnerability is exploitable over the network without requiring authentication, making it particularly dangerous for publicly accessible WordPress installations.

The flaw exists because user-supplied input is incorporated directly into SQL queries without proper sanitization or parameterization. When the plugin processes popup-related requests, it fails to adequately escape the id parameter before using it in database operations. This allows an attacker to inject malicious SQL syntax that modifies the intended query behavior.

The impact is primarily focused on data confidentiality, as successful exploitation enables extraction of sensitive database contents. However, the integrity and availability of the system remain unaffected according to the vulnerability assessment.

Root Cause

The root cause lies in the DataBase.php helper file and the Popup.php routes handler within the plugin. Specifically, the code at DataBase.php line 374 and Popup.php line 232 lacks proper input validation and prepared statement implementation.

The plugin fails to utilize WordPress's $wpdb->prepare() function correctly, which is the standard method for preventing SQL injection in WordPress development. Instead, user input from the id parameter is concatenated directly into SQL query strings.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests containing SQL injection payloads in the id parameter. Since the plugin exposes REST API routes for popup functionality, these endpoints can be targeted directly.

The exploitation mechanism involves appending UNION-based or time-based blind SQL injection payloads to extract data from the WordPress database. Given the unauthenticated nature of this vulnerability, any external attacker with network access to the WordPress site can attempt exploitation.

Detection Methods for CVE-2025-10862

Indicators of Compromise

• Unusual SQL error messages appearing in WordPress logs or displayed to users
• Unexpected database queries in MySQL slow query logs containing UNION SELECT statements
• Web server access logs showing requests to popup-related endpoints with suspicious id parameter values containing SQL syntax
• Database query patterns with abnormal execution times indicating time-based blind SQL injection attempts

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection attack signatures targeting the popup-builder-block plugin endpoints
• Implement intrusion detection rules to flag requests containing SQL keywords (UNION, SELECT, INSERT, DROP) in the id parameter
• Review WordPress debug logs for database errors related to malformed queries in the popup builder functionality
• Deploy database activity monitoring to detect anomalous query patterns originating from the WordPress application

Monitoring Recommendations

• Enable detailed logging for the WordPress REST API to capture all requests to plugin endpoints
• Configure alerting for multiple failed database queries originating from the same source IP address
• Implement rate limiting on popup-related API endpoints to slow down automated exploitation attempts
• Regularly audit database access logs for queries that return unusual amounts of data or access sensitive tables

How to Mitigate CVE-2025-10862

Immediate Actions Required

• Update the Popup builder with Gamification plugin to the latest patched version immediately
• If immediate patching is not possible, disable the affected plugin until a secure version can be installed
• Review WordPress database for signs of unauthorized data access or extraction
• Implement a Web Application Firewall (WAF) with SQL injection protection rules as an additional defense layer
• Audit user accounts and credentials for potential compromise and reset passwords if database breach is suspected

Patch Information

The vulnerability has been addressed in WordPress Changeset #3369146. Site administrators should update to the latest version of the plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

Additional vulnerability details and remediation guidance are available in the Wordfence Vulnerability Report.

Workarounds

• Disable the popup-builder-block plugin entirely until a patched version can be installed
• Implement server-level input filtering to block requests containing SQL injection patterns in the id parameter
• Use a security plugin such as Wordfence to add virtual patching capabilities that can block exploitation attempts
• Restrict access to WordPress REST API endpoints from untrusted networks using IP-based access controls

# Example: Block suspicious requests at the web server level (Apache .htaccess)
# Add to WordPress root .htaccess file as temporary mitigation
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} (union|select|insert|delete|drop|update|concat|load_file) [NC]
RewriteRule .* - [F,L]
</IfModule>