Introduction
When SQL injection flaws go unpatched in widely deployed WordPress plugins, the results include sensitive data exposure, credential leaks, and unauthorized access to the database. The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress, used for marketing popups and customer engagement, has a critical SQL injection vulnerability (CVE-2025-10862) that lets unauthenticated attackers extract sensitive information from the database.
Technical information
CVE-2025-10862 is a SQL injection vulnerability caused by improper handling of the id parameter in the plugin's database query logic. It affects all versions of the plugin up to and including 2.1.3.
The plugin does not sufficiently escape user input and does not use parameterized queries when it builds SQL statements. The vulnerable code is in these files:
includes/Helpers/DataBase.phpat line 374includes/Routes/Popup.phpat line 232
These code paths take the id parameter from the HTTP request and concatenate it directly into a SQL query. An unauthenticated attacker can put malicious SQL in the id parameter and get arbitrary SQL executed. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
This post does not reproduce the code, but you can read the vulnerable lines in the public plugin repository (see references).
Affected systems and versions
- Product: Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress
- Affected versions: All versions up to and including 2.1.3
- Vulnerable files:
includes/Helpers/DataBase.php(line 374),includes/Routes/Popup.php(line 232)
Vendor security history
Earlier security reviews and advisories have found recurring vulnerabilities in popup builder plugins for WordPress, this one included. Prior issues include:
- SQL injection vulnerabilities in earlier versions and similar plugins (Wordfence 2019)
- Cross-site scripting (XSS) and authorization flaws
- Multiple security issues in the plugin documented by Patchstack and Plugin Vulnerabilities
The vendor has released patches in response to disclosures, but how often new issues appear suggests persistent problems with secure coding and code review.
