CVE-2026-89270

Name of the Vulnerable Software and Affected Versions Popup Builder versions prior to 4.4.6

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to move all published popups to the trash using a single GET request. The issue is exacerbated by a flaw in the find() function within the SGPopup class, which returns false for normally published popups when the sg popup preview id parameter is used, triggering the trash action for every popup on the site simultaneously.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.