Wp Popup Builder CVE-2025-62902

The vulnerability presents a nuanced risk profile requiring contextual analysis of multiple signals. The CVSS 7.5 HIGH score reflects significant confidentiality impact (C:H) with network accessibility requiring no authentication, representing a genuine technical concern. However, real-world exploitation likelihood appears limited based on EPSS probability of 0.03% (10th percentile), indicating security researchers and threat actors have not prioritized this vulnerability in observed exploitation attempts. No public exploit identified at time of analysis and no CISA KEV listing further support lower immediate risk. The lack of integrity or availability impact (I:N, A:N) means this is purely an information disclosure issue-severity depends entirely on what sensitive data is exposed. For SSVC decision framework analysis: exploitation status is none observed, technical impact is partial (confidentiality only), and automatable is yes given the lack of authentication requirements. Priority should be moderate: organizations running affected versions should patch during normal maintenance cycles, with expedited patching only if the exposed information includes credentials or data enabling privilege escalation attacks. The primary risk is using disclosed information as reconnaissance for multi-stage attacks rather than direct system compromise.

An unauthenticated remote attacker performs reconnaissance against WordPress sites running WP Popup Builder by sending HTTP requests to known plugin endpoints or directly accessing plugin configuration files. Without requiring any authentication or user interaction, the attacker successfully retrieves sensitive system information such as database table prefixes, installation paths, API configuration details, or user enumeration data exposed by the plugin's insecure information handling. The attacker uses this disclosed information to map the site architecture, identify additional attack surfaces, and craft targeted attacks against other components. For example, disclosed database credentials or API keys could enable direct database access or third-party service compromise, while exposed user data facilitates phishing or credential stuffing campaigns. The low attack complexity and network accessibility make this vulnerability easily scalable across multiple WordPress installations using automated scanning tools.