Live › vulnerability › CVE-2026-112230
Go to dashboardThe Popup Builder WordPress plugin before 4.4.6 runs a maintenance routine on unauthenticated requests without checking permissions. An anonymous attacker can move popups to the Trash and overwrite their stored preview data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Popup Builder WordPress plugin before 4.4.6 are exposed, since the flaw is reachable without logging in. Sites that do not run this plugin can skip it. The sources do not say whether any non-default configuration is required.
No product ranges from the sources yet.
wp plugin get popup-builder --field=version4.4.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
This page as .md · .json · in your agent: get_signal("CVE-2026-112230")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.