What’s Vulnerable › Vulnerabilities

CVE-2026-89270: Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-31 · updated 2026-10-31
• Weakness: CWE-862

Description

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.

Summary

Popup Builder for WordPress through 4.4.5 lacks an authorization check, letting unauthenticated attackers trash all published popups with a single GET request. A second flaw in SGPopup::find() makes every popup appear unpublished when the sg_popup_preview_id parameter is present, so the trash action hits all popups at once. Rated CVSS 9.1 (critical); not listed in CISA KEV, so no confirmed in-the-wild exploitation is known. Update Popup Builder to a version later than 4.4.5, or disable the plugin until a patched release is available.

يعاني إضافة Popup Builder لـ WordPress حتى الإصدار 4.4.5 من غياب التحقق من التصريح، ما يتيح لمهاجم غير مصادق عليه نقل جميع النوافذ المنبثقة المنشورة إلى سلة المهملات عبر طلب GET واحد. ويضاعف خلل ثانٍ في SGPopup::find() الأمر، إذ يجعل كل نافذة منشورة تبدو غير منشورة عند وجود المعامل sg_popup_preview_id، فتُستهدف جميع النوافذ دفعة واحدة. التقييم 9.1 (حرج)، ولا يرد CVE في قائمة CISA KEV، لذا لا يُعرف استغلال مؤكد في الواقع. حدّثوا Popup Builder إلى إصدار أحدث من 4.4.5، أو عطّلوا الإضافة ريثما يتوفر إصدار مُصحّح.

Affected products

• Popup Builder: through 4.4.5

References

• https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L43
• https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L435
• https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1826
• https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1830
• https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L257
• https://plugins.trac.wordpress.org/changeset/3755160/popup-builder/trunk/com/classes/popups/SGPopup.php
• https://wordpress.org/plugins/popup-builder/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/13af3a6e-d3ef-41f0-9424-fe2c9b17c8bb?source=cve

Get alerted when CVE-2026-89270 or the next vulnerability affects your stack