CVE-2026-4302
SSRF Vulnerability in WowOptin WordPress Plugin Allows Arbitrary Requests
Publication date: 2026-03-21
Last updated on: 2026-03-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | optin | to 1.4.29 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WowOptin: Next-Gen Popup Maker plugin for WordPress has a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.4.29. This occurs because the plugin exposes a publicly accessible REST API endpoint (optn/v1/integration-action) that has no permission restrictions (permission_callback always returns true). This endpoint accepts user-supplied URLs and passes them directly to functions that make HTTP requests (wp_remote_get and wp_remote_post) without validating or restricting the URLs.
Because the plugin does not use the safer alternatives (wp_safe_remote_get/post) which provide built-in SSRF protections, an unauthenticated attacker can exploit this to make the web application send requests to arbitrary locations, including internal services. This can be used to query or modify information from internal systems that are not normally accessible externally.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to make the WordPress server send HTTP requests to arbitrary URLs, including internal network services that are otherwise inaccessible. This can lead to unauthorized querying or modification of internal information.
Potential impacts include data exposure from internal services, unauthorized actions triggered within the internal network, and possible manipulation of internal resources. Since the attacker does not need to be authenticated, this increases the risk of exploitation.
The vulnerability has a CVSS v3.1 base score of 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for HTTP POST requests to the publicly accessible REST API endpoint exposed by the WowOptin plugin at the path /wp-json/optn/v1/integration-action.'}, {'type': 'paragraph', 'content': 'Since the endpoint accepts unauthenticated POST requests with arbitrary data, suspicious or unexpected POST requests to this endpoint could indicate exploitation attempts.'}, {'type': 'paragraph', 'content': 'You can use network monitoring or web server access logs to detect such requests.'}, {'type': 'list_item', 'content': 'Use command-line tools like grep to search web server logs for POST requests to the endpoint, e.g.:'}, {'type': 'list_item', 'content': "grep 'POST /wp-json/optn/v1/integration-action' /var/log/apache2/access.log"}, {'type': 'list_item', 'content': 'Use curl or similar tools to test the endpoint manually, for example:'}, {'type': 'list_item', 'content': 'curl -X POST https://yourwordpresssite.com/wp-json/optn/v1/integration-action -d \'{"data":[]}\' -H \'Content-Type: application/json\''}, {'type': 'paragraph', 'content': 'Additionally, monitoring for unusual outbound HTTP requests originating from the WordPress server to arbitrary URLs may help detect exploitation attempts, as the vulnerability allows SSRF via wp_remote_get and wp_remote_post calls.'}] [3, 5]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the WowOptin: Next-Gen Popup Maker plugin to version 1.4.30 or later, where the vulnerability has been addressed.
The update replaces unsafe HTTP request functions with safe variants that include URL validation and restrict SSRF.
If updating immediately is not possible, consider restricting access to the vulnerable REST API endpoint by implementing firewall rules or web server access controls to block unauthenticated POST requests to /wp-json/optn/v1/integration-action.
Also, monitor your logs for suspicious activity and consider disabling or removing the plugin if it is not essential.