CVE-2026-112230

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data...

CVE-2026-112230 Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data...

CVE-2026-112230

The Popup Builder WordPress plugin (versions before 4.4.6 ) contains an authorization bypass vulnerability. A maintenance routine triggered by unauthenticated requests fails to perform proper authorization checks before trashing popup content. This allows unauthenticated attackers to move affecte...

EUVD-2026-108597

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data...

PT-2026-121770

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data...