CVE-2025-58641
BaseFortify
Publication date: 2025-09-03
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kamleshyadav | exit_intent_popup | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Server-Side Request Forgery (SSRF) in the WordPress Exit Intent Popup Plugin versions up to 1.0.1. It allows an unauthenticated attacker to make the affected website send HTTP requests to arbitrary domains controlled by the attacker. This can lead to exposure of sensitive information from other services running on the same system. [1]
How can this vulnerability impact me? :
The impact of this vulnerability includes the potential exposure of sensitive information from other services on the same system due to unauthorized HTTP requests initiated by the attacker. Although the severity is considered low (CVSS score 5.4), it can lead to broken access control issues and compromise confidentiality and integrity of data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for unexpected HTTP requests originating from the affected WordPress site to arbitrary external domains, which may indicate exploitation attempts. Since the vulnerability allows unauthenticated attackers to trigger HTTP requests to attacker-controlled domains, network traffic analysis tools or web server logs can be inspected for such suspicious outbound requests. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Exit Intent Popup WordPress plugin to version 1.0.3 or later, where the vulnerability is fixed. Alternatively, Patchstack offers virtual patching (vPatching) to auto-mitigate this vulnerability even before official patches are applied. [1]