Live › vulnerability › CVE-2026-89270
The Popup Builder WordPress plugin up to and including 4.4.5 fails to check user authorization, so an unauthenticated visitor can trash every published popup on the site with one GET request. A second flaw in SGPopup::find() makes the attack hit all popups at once when the sg_popup_preview_id parameter is present.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Any WordPress site running Popup Builder at version 4.4.5 or earlier is exposed, since the flaw needs no login and the GET request is reachable from the internet. Sites that do not run this plugin are not affected. The sources do not say whether non-default settings change exposure.
No product ranges from the sources yet.
4.4.5 are affected; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.
This page as .md · .json · in your agent: get_signal("CVE-2026-89270")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.