CVE-2026-89270
Received Received - Intake

Authorization Bypass in Popup Builder WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-89270
EUVD
EUVD-2026-114593

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the Popup Builder WordPress plugin up to version 4.4.5. It allows unauthenticated attackers to delete all published popups on a site with a single unauthenticated GET request. The flaw occurs because the plugin fails to verify user authorization for actions and has a secondary issue where a parameter causes all popups to be treated as trashable.

Detection Guidance

Check WordPress sites using Popup Builder plugin version 4.4.5 or lower. Look for unauthorized GET requests with the sg_popup_preview_id parameter or actions trashing popups without authentication.

Impact Analysis

If exploited, this vulnerability could allow attackers to permanently delete all marketing popups on your WordPress site without authentication. This could disrupt lead generation, marketing campaigns, and user engagement features relying on popups. The attack is simple to execute and requires no special privileges.

Compliance Impact

This vulnerability allows unauthenticated attackers to delete all published popups on a WordPress site, which could lead to unauthorized data loss or disruption of marketing campaigns. For GDPR, this may impact data integrity and availability if popups handle user data. For HIPAA, if popups collect protected health information, their deletion could violate integrity and availability requirements.

Mitigation Strategies

Update the Popup Builder plugin to the latest version beyond 4.4.5 immediately. Remove or disable the plugin if updates are unavailable. Review server logs for suspicious GET requests targeting popup actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart