CVE-2026-89270

CriticalCVSS 9.1

Published: 31/10/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Summary

The Popup Builder plugin for WordPress in versions up to and including 4.4.5 does not properly verify that a user is authorized to perform an action. An unauthenticated attacker can trash all published popups on the site with a single GET request, amplified by a second flaw in SGPopup::find() that causes the trash branch to fire against every popup simultaneously.

Risk Assessment

An unauthenticated attacker can destroy all marketing popups on the site, disrupting campaigns and customer communication. The flaw is trivially exploitable remotely without any credentials.

Recommendation

Update the Popup Builder plugin to a version newer than 4.4.5, and until then consider disabling it or restricting access to the site.

Other vulnerabilities in Popup Builder WordPress plugin

CVE-2026-112230Low
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests. This allows unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

Original NVD description (English source)

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS