CVE-2025-58641 MEDIUM

CVE-2025-58641: WordPress Exit Intent Popup Plugin <= 1.0.1 - Server Side Request Forgery (SSRF) Vulnerability

Vendor Kamleshyadav
Product Exit Intent Popup
Weakness CWE-918 · SSRF
Published September 3, 2025
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in kamleshyadav Exit Intent Popup exitintentpopup allows Server Side Request Forgery.This issue affects Exit Intent Popup: from n/a through <= 1.0.1.

Explanation of Vulnerability in Simple Terms

02Summary

Exit Intent Popup versions 1.0.1 and earlier contain a server-side request forgery vulnerability. An attacker on the network can craft requests that cause the affected site to make HTTP requests to internal or external systems. The vulnerability requires specific network conditions but does not require authentication or user interaction. Confidentiality and integrity of the site may be compromised.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal systems or external servers on the attacker's behalf.

Potential impact on your site

04Site Impact

Attackers could access internal services, exfiltrate data, or interact with external systems using your site as a proxy.

Conditions required to exploit

05Prerequisites

Network access; no authentication or user interaction required, but attack complexity is high.

Key dates

06Disclosure timeline

September 3, 2025 CVE published
May 12, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-0688 Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2026-10586 Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery CVE-2025-12375 Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery CVE-2026-32412 WordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-7798 FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter