Popup Builder Block CVE-2025-10861

The vulnerable code path is the plugin's demo-fetch functionality (includes/Routes/FetchDemo.php) which accepts a user-supplied URL parameter and performs insufficient validation before making a server-side request; the plugin must be installed and active on the WordPress site and the fetch route reachable by unauthenticated clients. No authentication, user interaction, or special non-default configuration is required (PR:N/UI:N), so default installations of the affected plugin are exploitable by any remote client that can reach the site. The principal limiting factors are: (1) this specific plugin must be present (it is one of many popup builders, not a core component), and (2) impact depends on what internal/cloud endpoints are reachable from the web server; isolated egress or a metadata-service-hardened host (e.g., IMDSv2) meaningfully reduces realizable impact. Note version 2.1.4 is only partially patched, so upgrading to 2.1.4 alone may not fully remove the condition.

Signals are mixed and point to a credible-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure surface: network-reachable, low-complexity, and exploitable by unauthenticated attackers with no user interaction - consistent with an SSRF reachable through a plugin REST route (see FetchDemo.php). However, the real-world exploitation signals temper this: EPSS is only 0.38% (30th percentile), indicating low modeled probability of exploitation in the near term, the CVE is NOT in CISA KEV (no confirmed active exploitation), and no public proof-of-concept is referenced in the provided data. The 7.5/C:H rating reflects confidentiality loss from reading internal services, but impact is bounded (I:N/A:N, scope Unchanged). A key caveat: the vendor states the flaw was only 'partially patched in version 2.1.4,' and the CVE covers 'all versions up to, and including, 2.1.4,' so 2.1.4 may remain vulnerable - defenders should not assume 2.1.4 is a safe fixed version without confirming the follow-up changeset (3379308). Net assessment: a real, remotely reachable unauthenticated SSRF worth patching, but current telemetry (low EPSS, no KEV, no referenced POC) suggests it is not under widespread active exploitation.

An unauthenticated attacker sends a crafted request to the plugin's demo-fetch endpoint supplying an attacker-controlled value in the URL parameter, causing the WordPress server to issue a server-side HTTP request to an internal target such as a cloud metadata endpoint (e.g., 169.254.169.254) or an internal admin service. The response or behavior is used to read internal data and map the internal network. No public exploit code is referenced in the provided data, and the low complexity (AC:L) with no authentication (PR:N) means exploitation requires only network reachability to the vulnerable site.