CVE-2025-10862: Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10862?
CVE-2025-10862 is classified as a SQL Injection vulnerability, which can allow attackers to manipulate database queries.
How do I fix CVE-2025-10862?
To fix CVE-2025-10862, update the Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin to version 2.1.4 or higher.
What versions are affected by CVE-2025-10862?
CVE-2025-10862 affects all versions of the Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin up to and including version 2.1.3.
What is SQL Injection in the context of CVE-2025-10862?
SQL Injection in CVE-2025-10862 refers to the vulnerability that allows malicious users to execute arbitrary SQL code through insufficiently escaped input.
Who is affected by CVE-2025-10862?
Anyone using the Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress up to version 2.1.3 is potentially affected by CVE-2025-10862.