CVE-2026-89270 Details
Description
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.
A vulnerability exists in the Popup Builder WordPress plugin, specifically in versions through 4.4.5, allowing unauthenticated users to bypass authorization and delete published popups. This issue arises because the plugin fails to properly verify user authorization before allowing actions to be performed. Exploitation is possible by sending a single unauthenticated GET request with specific parameters. The vulnerability is exacerbated by a related flaw in the SGPopup::find() method, which, when the sg_popup_preview_id parameter is included, incorrectly identifies all normally published popups as unavailable. This misidentification triggers the deletion process for every popup on the site simultaneously.
Users are advised to update the Popup Builder plugin to version 4.4.6 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Popup Builder | <= 4.4.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | [email protected] |