CVE-2026-4302: 
WordPress vulnerability analysis and mitigation

CVE-2026-4302 is a Server-Side Request Forgery (SSRF) vulnerability in the WowOptin: Next-Gen Popup Maker plugin for WordPress, affecting all versions up to and including 1.4.29. The flaw allows unauthenticated remote attackers to make arbitrary web requests originating from the web server, potentially targeting internal services. It was published on March 21, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-918 (Server-Side Request Forgery). The plugin exposes a publicly accessible REST API endpoint (optn/v1/integration-action) with a permission_callback set to __return_true, meaning no authentication is required to invoke it. Within the Webhook::add_subscriber() method, user-supplied URLs are passed directly to WordPress's wp_remote_get() and wp_remote_post() functions without any URL validation or sanitization. Critically, the plugin does not use the safer wp_safe_remote_get()/wp_safe_remote_post() alternatives, which include built-in SSRF protections. Relevant vulnerable code is visible in the plugin's source repository (WordPress Trac - class-webhook.php, WordPress Trac - class-rest-frontend.php).

Successful exploitation allows unauthenticated attackers to cause the WordPress server to issue HTTP requests to arbitrary internal or external destinations, enabling reconnaissance of internal network services, cloud metadata endpoints (e.g., AWS IMDSv1), and other resources not normally accessible from the internet. The vulnerability has a changed scope (S:C), meaning impact extends beyond the vulnerable component itself. Both confidentiality (low — data leakage from internal services) and integrity (low — potential modification of internal service state via POST requests) are affected, while availability is not directly impacted (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability requires no authentication and no user interaction, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.049% (0.000490), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WowOptin plugin (versions ≤ 1.4.29) using tools like WPScan, Shodan, or by checking /wp-content/plugins/optin/ for plugin presence.
2. Locate the vulnerable endpoint: The REST API endpoint optn/v1/integration-action is publicly accessible without authentication due to permission_callback: __return_true.
3. Craft the SSRF payload: Construct an HTTP POST request to https://target.com/wp-json/optn/v1/integration-action with a body containing a user-controlled URL parameter pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata, or http://internal-service:8080/admin).
4. Send the request: Submit the crafted request; the server will invoke wp_remote_get() or wp_remote_post() with the attacker-supplied URL, forwarding the response data.
5. Harvest results: Analyze the HTTP response from the WordPress server, which may reflect internal service data, enabling further lateral movement or credential harvesting (Wordfence, WordPress Trac - class-webhook.php).

• Network: Unusual outbound HTTP/HTTPS requests from the WordPress server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254); unexpected requests to non-standard internal ports.
• Logs: WordPress access logs showing repeated POST requests to /wp-json/optn/v1/integration-action from external or unknown IP addresses, especially with URL parameters pointing to internal hosts or metadata services.
• Web Server Logs: Entries showing the WordPress server initiating outbound connections to internal services shortly after receiving requests to the above endpoint.

Users should update the WowOptin: Next-Gen Popup Maker plugin to a version beyond 1.4.29, which includes the fix replacing wp_remote_get()/wp_remote_post() with their safe equivalents and adding URL validation. The patch changeset is available in the WordPress plugin repository (WordPress Trac Changeset). As a temporary workaround, site administrators can use a Web Application Firewall (WAF) rule to block unauthenticated requests to the /wp-json/optn/v1/integration-action endpoint, or disable the plugin until a patched version is applied (Wordfence).

Wordfence included CVE-2026-4302 in their weekly WordPress vulnerability report for the period of March 16–22, 2026, highlighting it as part of their ongoing plugin security monitoring (Wordfence Blog). RedPacket Security also published an alert and shared it on Mastodon, contributing to community awareness. No significant vendor statements or notable researcher commentary beyond standard disclosure have been identified.