CVE-2025-10861: 
WordPress vulnerability analysis and mitigation

The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to and including 2.1.4. The vulnerability was discovered and disclosed on October 24, 2025, and is tracked as CVE-2025-10861 (NVD).

The vulnerability stems from insufficient validation of URLs supplied via the URL parameter, allowing unauthenticated attackers to make web requests to arbitrary locations originating from the web application. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

This vulnerability can be exploited to query and modify information from internal services, as well as conduct network reconnaissance. The high CVSS score reflects the potential for unauthorized access to sensitive information through the exploitation of this SSRF vulnerability (NVD).

The vulnerability was partially patched in version 2.1.4 of the plugin. Users are advised to update to version 2.1.5 or later for a complete fix (Wordfence).