What is the CVSS score of CVE-2026-4302?

CVE-2026-4302 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wowoptin are affected by CVE-2026-4302?

The WowOptin popup plugin used on WordPress sites contains a critical flaw that allows attackers to hijack server resources and access internal systems without authentication.

How to fix or mitigate CVE-2026-4302?

Within 24 hours: Identify all WordPress installations running WowOptin plugin versions ≤1.4.29 and disable the plugin immediately. Within 7 days: Implement WAF rules to block requests to the optn/v1/integration-action endpoint and audit logs for suspicious REST API activity. Within 30 days: Monitor vendor for patch release; evaluate alternative popup solutions if patch timeline is unclear, and conduct network segmentation review to limit internal service exposure.

Wowoptin CVE-2026-4302

EUVD-2026-13980 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-21 Wordfence

GHSA-jrvw-hv7x-27p4

WordPress SSRF Wowoptin Wordpress Plugin Wpxpo

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 02:15 euvd

EUVD-2026-13980

Analysis Generated

Mar 21, 2026 - 02:15 vuln.today

CVE Published

Mar 21, 2026 - 01:24 nvd

HIGH 7.2

DescriptionCVE.org

The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.29. This is due to the plugin exposing a publicly accessible REST API endpoint (optn/v1/integration-action) with a permission_callback of __return_true that passes user-supplied URLs directly to wp_remote_get() and wp_remote_post() in the Webhook::add_subscriber() method without any URL validation or restriction. The plugin does not use wp_safe_remote_get/post which provide built-in SSRF protection. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

AnalysisAI

The WowOptin: Next-Gen Popup Maker plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability affecting all versions up to and including 1.4.29. An unauthenticated attacker can exploit a publicly accessible REST API endpoint (optn/v1/integration-action) that passes user-supplied URLs directly to wp_remote_get() and wp_remote_post() without validation, allowing arbitrary web requests from the server. This enables querying and modifying information from internal services with a CVSS score of 7.2 (High), though no active exploitation (KEV) or public POC has been documented at this time.

Technical ContextAI

This vulnerability affects the WowOptin plugin (CPE: cpe:2.3:a:wpxpo:wowoptin:_next-gen_popup_maker_–_create_stunning_popups_and_optins_for_lead_generation:*:*:*:*:*:*:*:*) and stems from CWE-918 (Server-Side Request Forgery). The plugin registers a REST API endpoint in class-rest-frontend.php with permission_callback set to __return_true, making it publicly accessible without authentication. The vulnerable code in class-webhook.php's Webhook::add_subscriber() method directly passes user-controlled URLs to WordPress HTTP API functions wp_remote_get() and wp_remote_post() without using the safe variants (wp_safe_remote_get/post) that include built-in SSRF protections like DNS rebinding prevention and private IP range filtering. This allows attackers to abuse the server as a proxy to make requests to arbitrary internal or external resources.

RemediationAI

Upgrade the WowOptin plugin to a version newer than 1.4.29 that addresses this SSRF vulnerability, checking the WordPress plugin repository at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3484392%40optin&new=3484392%40optin&sfp_email=&sfph_mail= for the patched version. Until patching is complete, consider temporarily disabling the plugin if not essential for business operations, or implement Web Application Firewall (WAF) rules to block unauthorized access to the optn/v1/integration-action REST API endpoint. Network-level controls such as restricting the WordPress server's ability to make outbound requests to internal network ranges and implementing egress filtering can provide defense-in-depth protection. Additional details are available in the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c3e480-0221-4913-bcce-f34ded9edca8?source=cve.