{"id":"CVE-2026-112230","kind":"vulnerability","aliases":["CVE-2026-112230"],"related":[],"title":"Popup Builder WordPress plugin lets anonymous visitors trash popups","description":"The Popup Builder  WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.","summary":"The Popup Builder WordPress plugin before 4.4.6 runs a maintenance routine on unauthenticated requests without checking permissions. An anonymous attacker can move popups to the Trash and overwrite their stored preview data.","severity":"low","cvss":3.7,"epss":0.00137,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","popup-builder","wordpress"],"not_affected_if":["plugin-updated"],"how_to_check":"- Check the installed Popup Builder plugin version in the WordPress admin under Plugins, or with `wp plugin get popup-builder --field=version`\n- unknown","fix":"- Update the Popup Builder plugin to `4.4.6` or later\n- unknown","status":"open","published_at":"2026-10-23T06:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:43:21+00:00","updated_at":"2026-10-25T04:43:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:43:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Popup Builder plugin to `4.4.6` or later\n- unknown","reach":"internet","title":"Popup Builder WordPress plugin lets anonymous visitors trash popups","impact":"low","summary":"The Popup Builder WordPress plugin before 4.4.6 runs a maintenance routine on unauthenticated requests without checking permissions. An anonymous attacker can move popups to the Trash and overwrite their stored preview data.","category":"package","nicknames":[],"who_cares":["wordpress","popup-builder"],"confidence":0.7,"needs_auth":"no","worst_case":"Anonymous users trash popups and overwrite their preview data","analyst_note":"","how_to_check":"- Check the installed Popup Builder plugin version in the WordPress admin under Plugins, or with `wp plugin get popup-builder --field=version`\n- unknown","needs_analyst":false,"not_affected_if":["plugin-updated"],"who_is_affected":"Sites running the Popup Builder WordPress plugin before 4.4.6 are exposed, since the flaw is reachable without logging in. Sites that do not run this plugin can skip it. The sources do not say whether any non-default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000564,"input_tokens":3353,"output_tokens":458,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112230':12A,15A '-2026':11A,14A '4.4.6':27B,59C 'affect':83C 'allow':78C 'anonym':6A,39B 'attack':40B,80C 'author':63C 'builder':2A,19B,23B,55C 'check':36B,64C 'content':68C 'cve':10A,13A 'data':52B,93C 'let':5A 'mainten':30B,71C 'move':42B,82C 'overwrit':48B,89C 'packag':16B 'perform':62C 'permiss':37B 'plugin':4A,25B,57C 'popup':1A,9A,18B,22B,43B,54C,67C,84C 'popup-build':17B 'preview':51B,92C 'request':34B,77C 'routin':31B,72C 'run':28B,74C 'store':50B,91C 'trash':8A,46B,66C,87C 'unauthent':33B,76C,79C 'visitor':7A 'without':35B 'wordpress':3A,20B,24B,56C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Popup Builder WordPress plugin before 4.4.6 are exposed, since the flaw is reachable without logging in. Sites that do not run this plugin can skip it. The sources do not say whether any non-default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112230","severity":null,"published_at":"2026-10-23T06:17:06+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112230","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112230","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}