High · published February 4, 2026
⚡ A sneaky SQL injection lurks in the Popup builder plugin for WordPress, affecting all versions up to 2.2.0! Just like a clever thief slipping a fake invoice into the stack, this flaw can let attackers pull sensitive data from your database. 🔥 Think of it like a waiter who doesn’t double-check your order and serves up whatever comes in, including some questionable additions from the kitchen. In this case, the plugin lets attackers append their own SQL queries without sufficient scrutiny, leading to potentially disastrous data leaks. An attacker could exploit this vulnerability to extract sensitive information from your database, essentially giving them the keys to the kingdom. They could retrieve user data, transaction records, or even private content. This poses a significant risk, especially for eCommerce sites using WooCommerce triggers that rely on this plugin.
Think of it like a waiter who doesn’t double-check your order and serves up whatever comes in, including some questionable additions from the kitchen. In this case, the plugin lets attackers append their own SQL queries without sufficient scrutiny, leading to potentially disastrous data leaks. This vulnerability arises from insufficient escaping of user-supplied parameters across multiple REST API endpoints, allowing unauthenticated attackers to inject harmful SQL queries into existing ones.
An attacker could exploit this vulnerability to extract sensitive information from your database, essentially giving them the keys to the kingdom. They could retrieve user data, transaction records, or even private content. This poses a significant risk, especially for eCommerce sites using WooCommerce triggers that rely on this plugin. Update the Popup builder plugin immediately to version 2.2.1 or later for unauthenticated users, and to version 2.2.3 for Administrator+ users to ensure full protection against this SQL injection. Regularly audit your plugins to ensure they’re up to date and secure. You’ve got this! With a quick update, you’ll shore up your defenses and keep your site safe. 🛡️