PT-2026-121770

CVE-2026-112230

·

Published

2026-10-23

·

Updated

2026-10-23

Description by

CVSS 3.1
3.7
Low
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
CVE-2026-112230
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com