Executive brief
PopAd, a WordPress plugin used for managing advertisements, contains a security flaw that could allow an administrator to make the server send unauthorized requests. An attacker with administrative access could use this to probe internal network services or access sensitive information that is not publicly available. While the risk is limited because it requires high-level access, it could be used to pivot into other parts of a company's internal infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the PopAd plugin for WordPress (versions <= 1.0.4). The flaw is classified under CWE-918 and occurs because the application does not properly validate user-supplied URLs before making server-side requests. An attacker with Administrator privileges can exploit this to force the server to perform requests to arbitrary domains or internal network resources. This could lead to information disclosure of internal services or metadata. The vulnerability has a high complexity (AC:H) and requires high privileges (PR:H). As of the latest advisory, no official patch has been released.
Affected products
- PopAd PopAd <= 1.0.4
Timeline
- 2025-07-14: other: Vulnerability reported by researcher Nabil Irawan
- 2025-09-26: advisory: Initial advisory published by Patchstack
- 2026-06-15: disclosed: CVE published to NVD