CVE-2026-4302: SSRF in WowOptin: Next-Gen Popup Maker

The SSRF vulnerability in WowOptin allows an attacker to craft malicious URLs that are then processed by the plugin's wpremoteget() and wpremotepost() functions without proper validation. This means an attacker can potentially trigger requests to internal services or resources that are not directly accessible from the outside. For example, an attacker could attempt to access internal admin panels, database servers, or other sensitive systems within the WordPress environment. The lack of authentication required to exploit this vulnerability significantly increases the potential attack surface, as any unauthenticated user can trigger the SSRF. This vulnerability is similar in nature to other SSRF vulnerabilities where attackers leverage internal network access to gain further control or exfiltrate sensitive data.

1. Reserved2026-03-16
2. Published2026-03-21
3. Modified2026-04-08
4. EPSS updated2026-03-28

The primary mitigation for CVE-2026-4302 is to immediately upgrade the WowOptin: Next-Gen Popup Maker plugin to version 1.4.30 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the optn/v1/integration-action endpoint. Alternatively, restrict network access to the WordPress server to only allow outbound connections to trusted domains. Review and audit any existing integration actions to ensure they are not susceptible to SSRF vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting to access an internal resource via the vulnerable endpoint and verifying that the request is blocked or fails.

Active installs

1KKnown

Plugin rating