CVE Alert: CVE-2025-10862 – roxnor – Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers

Risk verdict

High-risk unauthenticated SQL injection in the Popup Builder plugin; remote exploitation is possible without credentials, though no active exploitation is currently reported.

Why this matters

Attackers can potentially extract sensitive database contents (customer data, orders, WooCommerce details) with minimal preconditions, risking data breach and regulatory exposure. For online stores, this can enable theft of payment data or customer records and erode trust, with potential financial impact and downtime during remediation.

Most likely attack path

An attacker remotely targets sites running the affected plugin, supplying crafted id parameters to trigger the injection. With no authentication and no user interaction required, a single probe can yield data via the database, subject to the plugin’s query scope. Lateral movement is limited by the scope of the compromised query, but data exfiltration remains feasible if access exists to the vulnerable database.

Who is most exposed

WordPress sites using the vulnerable popup-builder plugin, especially those tied to WooCommerce or handling customer data on shared or SME hosting.

Detection ideas

• Monitor for unusual SQL errors or database syntax in requests containing id parameters.
• Detect high-volume or automated scans targeting the plugin’s endpoints.
• Flag anomalous data access patterns or large data dumps from the WordPress database.
• Inspect application logs for failed/blocked queries linked to the plugin.

Mitigation and prioritisation

• Apply the vendor patch or upgrade to a non-vulnerable version immediately; if unavailable, disable the plugin until fixed.
• Implement a WAF rule to block suspicious id parameter inputs and known SQLi payloads.
• Enforce strict input validation and parameterised queries at the application layer where feasible.
• Restrict database permissions used by the plugin; monitor for unusual DB access.
• Plan patch adoption in the next change window; test in staging before production.