External risk intelligence

Green Popups Blind SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-94388

This vulnerability affects a WordPress plugin designed to display popups on websites. As such, the component is intended to be integrated into public-facing web pages to interact with site visitors, making it commonly accessible via the public internet in its standard deployment.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Green Popups plugin for WordPress, specifically related to how it handles user input in database queries. This SQL injection flaw could allow unauthorized access to sensitive information if exploited. The main concern is confirming if this plugin is in use and assessing potential exposure.

Website popups have a critical database vulnerability.
Directs risk to customer data and website integrity.
Confirm relevance and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a website using the vulnerable plugin. This could allow them to manipulate database queries, potentially leading to unauthorized access to sensitive information or disruption of services.

No authentication required.
Triggered by specially crafted input.
Risk of unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

A blind SQL injection vulnerability could allow an attacker to infer sensitive information from the database by observing the application's responses. This may occur when the affected Green Popups component does not properly sanitize user-supplied input before incorporating it into SQL queries.

Database information could be at risk.
Attackers may observe application behavior.
Information leakage or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This SQL injection vulnerability in Halfdata Green Popups likely requires coordination between the application owner responsible for the WordPress site and the platform or infrastructure team managing the web hosting environment. The first practical move is to identify all instances of the affected plugin, assess their reachability from external networks, confirm their business criticality, and then determine the accountable owner for remediation planning.

Application owners should own the issue.
Verify plugin reachability and business impact.
Plan coordinated remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Green Popups plugin used for?

Green Popups is a WordPress plugin designed to display interactive pop-up elements on websites. It acts as a bridge between the site and its visitors, handling visual components and user interactions that are typically served directly to the public-facing side of a website.

What does SQL injection mean for CVE-2026-94388?

This vulnerability, classified as CWE-89, occurs when the plugin fails to properly clean user-provided input before using it in database commands. Because it is a 'Blind' SQL injection, an attacker cannot see the data directly but can infer sensitive information by observing how the website responds to specific, crafted requests.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted web requests to the plugin. No authentication is needed to attempt this. The vulnerability does not trigger during standard, legitimate use by visitors; it only occurs when input is maliciously manipulated to alter the underlying database query.

Is my website at risk from this vulnerability?

Halo Surface Signal indicates this plugin is intended for public-facing web pages to interact with visitors. Because it is designed to be accessible via the public internet in its standard deployment, any site running versions before 7.6.3 should be considered potentially reachable and at risk.

What should I do if I use Green Popups?

Begin by identifying all WordPress installations where this plugin is currently active. Once you have an inventory, assess whether these sites are reachable from the internet and confirm their business importance. After identifying the accountable owners, plan to update the plugin to version 7.6.3 or later to neutralize the flaw.

References

patchstack.com/database/wordpress/plugin/halfdata-green-popups/vulne…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.