CVE-2026-112230 in Popup Builder Plugin
Summary
by MITRE • 10/23/2026
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Popup Builder versions prior to 4.4.6 represents a critical failure in access control mechanisms within the WordPress plugin ecosystem. This flaw specifically manifests during the execution of maintenance routines that are triggered by unauthenticated HTTP requests. The core technical deficiency lies in the absence of authorization checks before processing commands related to trashing popup content. In secure software design, any operation that modifies state or deletes data must verify that the requesting user possesses the necessary privileges for such actions. However, this plugin fails to validate whether the requester is an authenticated administrator or has been granted specific capabilities associated with managing popups. Consequently, the endpoint responsible for moving popups to the trash operates without verifying identity or permissions, effectively exposing a privileged function to public access.
From a technical perspective, this vulnerability allows unauthenticated attackers to exploit the maintenance routine by sending crafted requests that instruct the system to move targeted popup content into the WordPress Trash. This action not only disrupts the availability of specific website features but also leads to data integrity issues as it overwrites stored preview data associated with those popups. The ability to overwrite preview data suggests a potential for further exploitation, where an attacker might manipulate how these elements are rendered or displayed before they are permanently deleted or restored. This behavior indicates that the plugin does not properly sanitize inputs nor enforce strict role-based access control on endpoints handling sensitive content management operations.
The operational impact of this vulnerability is significant for website administrators and end-users alike. For site owners, it means that malicious actors can arbitrarily remove functional elements from their websites without needing valid credentials, leading to service disruption and potential loss of configuration data. The overwriting of preview data complicates recovery efforts, as the original state of the popup configurations may be irretrievably altered or corrupted before restoration attempts are made. For end-users visiting the affected site, this can result in broken layouts, missing interactive elements, or inconsistent user experiences depending on which popups were targeted and how their removal affects page structure.
This vulnerability aligns with CWE-284, Improper Access Control, as it involves a failure to enforce proper authorization policies for critical functions. Additionally, the exploitation method relates to ATT&CK technique T1505.003, Server Software Component: Web Shell, if an attacker were to leverage this access control flaw to upload malicious scripts, though in its current form described here, it primarily facilitates unauthorized modification and deletion of content via T1489 Service Stop or similar disruption techniques within the application layer. The lack of authentication checks on administrative functions is a common misconfiguration that underscores the importance of rigorous input validation and permission verification in all plugin development practices.
To mitigate this vulnerability, immediate action should be taken to update the Popup Builder plugin to version 4.4.6 or later, where these authorization gaps have been addressed by developers. Until an upgrade can be performed, administrators may consider implementing temporary web application firewall rules that restrict access to known vulnerable endpoints based on IP reputation or request patterns indicative of automated exploitation attempts. Furthermore, it is advisable to review server logs for signs of unauthorized trashing activities and restore affected popups from backups if available. Long-term remediation involves adopting secure coding standards that mandate explicit permission checks before executing any state-changing operations, ensuring that only authenticated users with appropriate roles can interact with sensitive administrative features.