CVE-2025-10861: 
WordPress vulnerability analysis and mitigation

CVE-2025-10861 is a Server-Side Request Forgery (SSRF) vulnerability in the "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers" WordPress plugin, developed by Roxnor. It affects all versions up to and including 2.1.4, and allows unauthenticated attackers to make arbitrary web requests from the server by supplying unsanitized URLs via the URL parameter. The vulnerability was disclosed on October 24, 2025, and was only partially addressed in version 2.1.4. It carries a CVSS v3.1 base score of 7.5 (High), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is classified as CWE-918 (Server-Side Request Forgery), stemming from insufficient validation of URLs supplied via the URL parameter in the plugin's FetchDemo.php route handler (specifically at lines 15 and 35 of includes/Routes/FetchDemo.php in version 2.1.2). Because no authentication is required to reach this endpoint, any remote attacker can craft a request that causes the WordPress server to issue HTTP requests to arbitrary internal or external destinations. The vulnerability was partially mitigated in changeset 3369146 and further addressed in changeset 3379308, but full remediation was not achieved in version 2.1.4 (Wordfence, WP Trac Changeset 3369146, WP Trac Changeset 3379308).

Successful exploitation allows unauthenticated attackers to leverage the WordPress server as a proxy to reach internal network services, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and other resources not directly accessible from the internet. This primarily impacts confidentiality — attackers can exfiltrate sensitive data from internal services or enumerate the internal network topology — while integrity and availability are not directly affected per the CVSS assessment. In cloud-hosted environments, SSRF can be particularly severe, potentially exposing instance credentials or other secrets via metadata APIs (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-10861 as of the available data. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any remote attacker who can reach the WordPress site. The EPSS score is approximately 0.032% (0.000320), indicating a currently low probability of exploitation in the near term. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the "Popup builder with Gamification" plugin (slug: popup-builder-block) in versions ≤ 2.1.4 using tools like WPScan, Shodan, or by checking /wp-content/plugins/popup-builder-block/ for accessible files.
2. Locate the vulnerable endpoint: The SSRF-vulnerable route is exposed via the plugin's REST API or internal route handler in includes/Routes/FetchDemo.php, accessible without authentication.
3. Craft the SSRF payload: Send an HTTP request to the vulnerable endpoint with a controlled URL parameter pointing to an internal target, for example: GET /wp-json/popup-builder-block/v1/fetch-demo?url=http://169.254.169.254/latest/meta-data/ (exact endpoint path may vary by plugin version).
4. Retrieve internal data: The server fetches the specified URL and returns the response, allowing the attacker to read cloud metadata, internal service responses, or probe internal network hosts and ports.
5. Expand access: Use discovered credentials (e.g., cloud IAM tokens from metadata endpoints) or internal service information to pivot further into the environment (Wordfence, WP Trac FetchDemo.php).

• Network: Outbound HTTP/HTTPS requests from the WordPress server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata addresses (169.254.169.254); unusual outbound connections to unexpected external hosts initiated by the web server process.
• Logs: WordPress access logs showing requests to the plugin's fetch/demo REST API endpoint (e.g., containing popup-builder-block and a url= parameter) from external IP addresses; repeated requests with varying url parameter values suggesting enumeration.
• Process: Web server process (e.g., apache2, nginx, php-fpm) initiating outbound connections to internal network hosts or metadata services, observable via netstat or endpoint detection tools.

The vulnerability was partially patched in version 2.1.4 of the plugin (changesets 3369146 and 3379308), but full remediation was not achieved in that release. Site administrators should monitor the WordPress plugin repository for a fully patched version beyond 2.1.4 and update as soon as one is available. As an interim workaround, consider disabling the plugin entirely if it is not critical to site operations, or implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint containing suspicious url parameter values. Network-level controls should also restrict outbound connections from the web server to internal IP ranges and cloud metadata endpoints (Wordfence, WP Trac Changeset 3379308).

Wordfence disclosed the vulnerability on October 24, 2025, and included it in their weekly WordPress vulnerability report for October 20–26, 2025. The vulnerability received standard aggregation coverage across security databases (Vulners, CIRCL, ENISA EUVD) and was noted on social media by accounts such as RedPacketSecurity on Mastodon. No significant vendor statements beyond the Wordfence advisory or notable researcher commentary have been identified (Wordfence Weekly Report, Wordfence).