CVE-2026-112230

LowCVSS 3.7

Published: 23/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests. This allows unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

Risk Assessment

An unauthenticated attacker can damage or break popups on the site, causing content unavailability and possible display errors. It does not directly lead to code execution.

Recommendation

Update the Popup Builder plugin to version 4.4.6 or later. Check the Trash and restore any removed popups.

Other vulnerabilities in Popup Builder WordPress plugin

CVE-2026-89270Critical
The Popup Builder plugin for WordPress in versions up to and including 4.4.5 does not properly verify that a user is authorized to perform an action. An unauthenticated attacker can trash all published popups on the site with a single GET request, amplified by a second flaw in SGPopup::find() that causes the trash branch to fire against every popup simultaneously.

Original NVD description (English source)

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS