CVE-2023-6294 is a High severity (CVSS 7.2) server side request forgery in the Popup Builder WordPress plugin before version 4.2.6. A user with the administrator role on a Multisite network can make the server send requests to addresses of their choosing. Update the plugin to 4.2.6 or later.
What's affected
The NVD description and WPScan agree.
- Affected: Popup Builder (the plugin by Sygnoos) before 4.2.6.
- Fixed: 4.2.6. WPScan lists "Fixed in 4.2.6".
- Conditions: the attacker needs the administrator role, and the description limits the issue to Multisite configurations.
- Severity: 7.2 High. The weaknesses are CWE-918, server side request forgery, and CWE-22, path traversal.
- Credit: WPScan lists Sebastian Neef as the researcher, and the entry was published on 17 January 2024.
On a single site, an administrator can already do almost anything, so the issue matters in Multisite, where site administrators are not meant to be trusted with the whole network.
How to check if you're exposed
Check the plugin version on each site or network.
wp plugin list --fields=name,status,version | grep popup-builder
wp plugin update popup-builder
In a Multisite network, check each site, since the plugin can be activated per site or network wide. Then ask a policy question: who holds the administrator role on individual sites in the network? On shared hosting or agency networks those users may be customers.
Also check where the network's servers can reach. If web servers can call internal services and cloud metadata addresses, an SSRF bug becomes much more useful to an attacker.
What to do now
- Update Popup Builder to 4.2.6 or later across the network.
- Review who has the administrator role on each Multisite subsite and remove accounts that no longer need it.
- Block web servers from reaching cloud metadata addresses and internal admin interfaces where they do not need to.
- Require IMDSv2 or the equivalent on cloud hosts so a forged request cannot read instance credentials easily.
- Log outbound requests from the web tier, so unusual internal destinations stand out.
Why it matters
Server side request forgery means the application makes a request on behalf of a user, to an address the user picked. The description says the plugin does not validate a parameter before making a request to it. The server's network position, which may include internal hosts and metadata services, is then available to whoever controls that parameter.
The administrator requirement lowers the score, and the Multisite condition lowers it further in practice. It still deserves attention for hosting providers and agencies, where site administrators are customers and the network owner is responsible for what they can reach. The kev flag is false and no exploitation in the wild is reported in the sources.
Quick check
Does this affect single site installs?
The description limits it to Multisite. A single site administrator already has broad power over the site.
Which version fixes it?
4.2.6, per WPScan.
Sources
Last reviewed: 19 October 2026.
