---
id: "CVE-2026-89270"
kind: "vulnerability"
aliases: ["CVE-2026-89270"]
title: "Popup Builder WordPress plugin: unauthenticated request trashes all published popups"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "popup-builder", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-31T07:16:37+00:00"
first_seen_at: "2026-10-31T07:34:07+00:00"
updated_at: "2026-10-31T07:34:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89270", "first_seen_at": "2026-10-31T07:34:07+00:00"}]
---

# Popup Builder WordPress plugin: unauthenticated request trashes all published popups

The Popup Builder WordPress plugin up to and including 4.4.5 fails to check user authorization, so an unauthenticated visitor can trash every published popup on the site with one GET request. A second flaw in SGPopup::find() makes the attack hit all popups at once when the sg_popup_preview_id parameter is present.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look at the installed plugin version in the WordPress admin plugin list, or in the plugin's main file header.
- Check whether the site still has published popups after a suspicious request, from the Popup Builder list in the admin.

## Fix

- Popup Builder versions up to and including `4.4.5` are affected; the sources do not name a fixed version.

## Timeline

- 2026-10-31T07:34:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89270

## From the sources

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_