An authorization bypass in the WordPress Popup Builder plugin, through version 4.4.5, lets an unauthenticated attacker trash every published popup on a site with a single GET request.
What Is It
CVE-2026-89270 is a missing authorization flaw (CWE-862) in the "Popup Builder – Create highly converting, mobile friendly marketing popups." plugin for WordPress. The plugin does not check that a user is allowed to perform an action. Because of this, an unauthenticated attacker can trash all published popups on a site with one unauthenticated GET request.
A second flaw in SGPopup::find() makes the attack worse. When the sg_popup_preview_id parameter is present, that function returns false for every normally published popup. This causes the trash branch to run against every popup on the site at once.
Wordfence reported the issue, and NVD published it on 2026-10-31. Its NVD status is currently "Received."
Why It Matters
Wordfence scores the flaw CVSS 3.1 9.1 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H:
- Network-reachable, low complexity: the attacker needs no special conditions.
- No privileges or user interaction required: anyone who can reach the site can trigger it.
- High integrity and availability impact: all published popups can be removed in one request.
- No confidentiality impact is listed.
Sites that use popups for marketing, lead capture or notices can lose all of them at once, with no login needed.
The supplied CISA KEV data contains no entry for this CVE. The supplied sources do not confirm active exploitation.
What's Vulnerable
- Product: Popup Builder – Create highly converting, mobile friendly marketing popups. (WordPress plugin)
- Vendor: popupbuilder
- Affected versions: all versions up to and including 4.4.5
The source references point to the vulnerable code in version 4.4.5:
- com/classes/Filters.php, lines 43 and 435
- com/classes/popups/SGPopup.php, lines 257, 1826 and 1830
Patch Status
The supplied data does not name a fixed release. The references include a WordPress plugin repository changeset (3755160) that changes SGPopup.php in the plugin's trunk, which suggests a code fix is underway or done.
The supplied data does not include a required action or formal remediation guidance. Administrators should check the plugin page and the Wordfence advisory for a release newer than 4.4.5 and update when one is available. Until then, treat every installation at 4.4.5 or below as vulnerable.
Sources
- NVD – CVE-2026-89270
- Wordfence Threat Intel advisory
- WordPress.org – Popup Builder plugin page
- WordPress Plugin Trac – Changeset 3755160 (SGPopup.php)
- WordPress Plugin Trac – Filters.php L43 (v4.4.5)
- WordPress Plugin Trac – Filters.php L435 (v4.4.5)
- WordPress Plugin Trac – SGPopup.php L257 (v4.4.5)
- WordPress Plugin Trac – SGPopup.php L1826 (v4.4.5)
- WordPress Plugin Trac – SGPopup.php L1830 (v4.4.5)