CVE-2025-13192 – This SQL injection vulnerability in the Popup B... (How to Fix)

📋 TL;DR

This SQL injection vulnerability in the Popup Builder WordPress plugin allows unauthenticated attackers to inject malicious SQL queries through REST API endpoints. Attackers can extract sensitive information from the database, including user credentials and other confidential data. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers WordPress plugin

Versions: All versions up to and including 2.2.0

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: WordPress sites with the vulnerable plugin installed and activated are affected regardless of configuration

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data exfiltration, privilege escalation, and potential site takeover

🟠

Likely Case

Extraction of sensitive data including user information, plugin settings, and potentially WordPress credentials

🟢

If Mitigated

Limited impact with proper network segmentation and database access controls

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

SQL injection via REST API endpoints makes exploitation straightforward for attackers with basic skills

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.2.3

Vendor Advisory: https://plugins.trac.wordpress.org/browser/popup-builder-block

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Popup Builder' plugin
4. Click 'Update Now' if update is available
5. If no update appears, manually update to version 2.2.3 or later

🔧 Temporary Workarounds

Disable vulnerable REST API endpoints

all

Temporarily disable the affected REST API endpoints until patching is possible

Add to wp-config.php: define('DISABLE_WP_REST_API', true);

Web Application Firewall rule

all

Block SQL injection patterns targeting the popup-builder REST endpoints

WAF specific - create rule to block requests containing SQL injection patterns to /wp-json/popup-builder/*

🧯 If You Can't Patch

Deactivate and remove the vulnerable plugin immediately
Implement strict network segmentation and database access controls to limit potential damage

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'Popup Builder' version ≤2.2.0

Check Version:

wp plugin list --name='popup-builder' --field=version

Verify Fix Applied:

Confirm plugin version is 2.2.3 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed REST API requests to popup-builder endpoints
Unexpected database connections from web server

Network Indicators:

SQL injection patterns in HTTP requests to /wp-json/popup-builder/*
Unusual outbound database connections from web server

SIEM Query:

source="web_logs" AND uri="/wp-json/popup-builder/*" AND (request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT" OR request_body CONTAINS "INSERT")

📊 Metadata

CVE ID: CVE-2025-13192

CVSS v3 Score: 8.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE: CWE-89

EPSS Score: 0.1% exploit probability (28.6th percentile)

Published: February 5, 2026

Last Updated: February 5, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-13192, you might also want to check these: