{"id":"CVE-2026-89270","kind":"vulnerability","aliases":["CVE-2026-89270"],"related":[],"title":"Popup Builder WordPress plugin: unauthenticated request trashes all published popups","description":"The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.","summary":"The Popup Builder WordPress plugin up to and including 4.4.5 fails to check user authorization, so an unauthenticated visitor can trash every published popup on the site with one GET request. A second flaw in SGPopup::find() makes the attack hit all popups at once when the sg_popup_preview_id parameter is present.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","popup-builder","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Look at the installed plugin version in the WordPress admin plugin list, or in the plugin's main file header.\n- Check whether the site still has published popups after a suspicious request, from the Popup Builder list in the admin.","fix":"- Popup Builder versions up to and including `4.4.5` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-31T07:16:37+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:24+00:00","updated_at":"2026-10-31T07:34:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T07:34:24Z","model":"claude-haiku-5-5","output":{"fix":"- Popup Builder versions up to and including `4.4.5` are affected; the sources do not name a fixed version.","reach":"internet","title":"Popup Builder WordPress plugin: unauthenticated request trashes all published popups","impact":"low","summary":"The Popup Builder WordPress plugin up to and including 4.4.5 fails to check user authorization, so an unauthenticated visitor can trash every published popup on the site with one GET request. A second flaw in SGPopup::find() makes the attack hit all popups at once when the sg_popup_preview_id parameter is present.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","popup-builder","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attackers unpublish or trash all site popups without logging in.","analyst_note":"Confirm a patched version number and whether a fix is published; the sources only state affected versions up to 4.4.5.","how_to_check":"- Look at the installed plugin version in the WordPress admin plugin list, or in the plugin's main file header.\n- Check whether the site still has published popups after a suspicious request, from the Popup Builder list in the admin.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running Popup Builder at version 4.4.5 or earlier is exposed, since the flaw needs no login and the GET request is reachable from the internet. Sites that do not run this plugin are not affected. The sources do not say whether non-default settings change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000718,"input_tokens":4220,"output_tokens":593,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-89270':13A,16A '4.4.5':34B,104C 'action':122C 'amplifi':147C 'attack':64B,129C,145C 'author':39B,95C,118C 'branch':175C 'builder':2A,20B,27B,81C 'bypass':96C 'caus':172C 'check':37B 'convert':84C 'creat':82C 'cve':11A,14A 'due':107C 'everi':46B,159C,179C 'fail':35B 'fals':157C 'find':61B,154C 'fire':177C 'flaw':58B,151C 'friend':86C 'get':54B,142C 'high':83C 'hit':65B 'host':23B 'id':75B,168C 'includ':33B,103C 'make':62B,124C 'market':87C 'mobil':85C 'normal':160C 'one':53B 'packag':17B 'paramet':76B,169C 'perform':120C 'plugin':4A,29B,89C,110C 'popup':1A,10A,19B,26B,48B,67B,73B,80C,88C,134C,162C,166C,180C 'popup-build':18B 'possibl':126C 'present':78B,171C 'preview':74B,167C 'proper':112C 'publish':9A,47B,133C,161C 'request':6A,55B,143C 'return':156C 'second':57B,150C 'self':22B 'self-host':21B 'sg':72B,165C 'sgpopup':60B,153C 'simultan':184C 'singl':140C 'site':51B,137C,183C 'trash':7A,45B,131C,174C 'unauthent':5A,42B,128C,141C 'user':38B,116C 'verifi':113C 'version':99C 'visitor':43B 'vulner':93C 'wordpress':3A,24B,28B,91C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running Popup Builder at version 4.4.5 or earlier is exposed, since the flaw needs no login and the GET request is reachable from the internet. Sites that do not run this plugin are not affected. The sources do not say whether non-default settings change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89270","severity":null,"published_at":"2026-10-31T07:16:37+00:00","modified_at":"2026-10-31T07:16:37+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}