Popup Builder: Missing authorization allows unauthenticated popup trashing
Summary
The WordPress plugin Popup Builder up to and including version 4.4.5 does not check whether a user is authorized to perform certain actions. An unauthenticated attacker can move all published popups on the site to the Trash with a single GET request. A second flaw in the preview handling makes the action affect every published popup at once. No login or user interaction is needed, so any public WordPress site with the plugin is exposed.
Affected
- Popup Builder (WordPress plugin) versions 0 to and including 4.4.5
Fixed in
- Version 4.4.6 is the likely fix (inferred from the vendor changelog, not confirmed by the CVE record). Unknown whether it fixes both flaws.
Workaround
- No vendor workaround known.
- Deactivating the plugin until it is updated removes the exposure (recommendation, not a vendor statement).
Exploitation
- Not known to be exploited (OffSeq, as of 30 Oct 2026).
- No public proof of concept or in-the-wild reports found. This is not a confirmed absence of exploitation.
- The plugin has a history of mass exploitation through an earlier XSS flaw (CVE-2023-6000).
Our recommendation
- Update Popup Builder to version 4.4.6 or later on all WordPress sites, and enable automatic plugin updates where possible.
- If an update is not possible right away, deactivate the plugin.
- Check the Trash for missing popups and restore them.
- Monitor web server logs for unauthenticated requests with the parameter sg_popup_preview_id.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WordPress.org: Popup Builder plugin page and changelog wordpress.org
- Wordfence threat intelligence: CVE-2026-89270 www.wordfence.com
- Trac: Filters.php at tag 4.4.5 (line 43) plugins.trac.wordpress.org
- Trac: SGPopup.php at tag 4.4.5 (line 1826) plugins.trac.wordpress.org
- OffSeq Radar: CVE-2026-89270 radar.offseq.com
- Techzine: Thousands of websites infected via vulnerable Popup Builder plugin www.techzine.eu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:21.
Original description (NVD)
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.
NVD references (8)
- https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L43
- https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L435
- https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1826
- https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1830
- https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L257
- https://plugins.trac.wordpress.org/changeset/3755160/popup-builder/trunk/com/classes/popups/SGPopup.php
- https://wordpress.org/plugins/popup-builder/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/13af3a6e-d3ef-41f0-9424-fe2c9b17c8bb?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.