Skip to content
Threat Feed
Subscribe
critical advisory

Popup Builder: Authorization bypass and arbitrary popup deletion (CVE-2026-89270)

The Popup Builder WordPress plugin contains an authorization bypass vulnerability (CVE-2026-89270) that allows unauthenticated attackers to bulk delete published popups via a crafted GET request.

CVE search metadata

CVE search record: CVE-2026-89270. Severity: critical. CVSS: 9.1. KEV: no. Product: Popup Builder (<= 4.4.5). Brief: Popup Builder: Authorization bypass and arbitrary popup deletion (CVE-2026-89270). Brief link: https://feed.craftedsignal.io/briefs/2026-10-popup-builder-auth-bypass/

Triage facts

Revision 1
Applicability
Popup Builder (<= 4.4.5)
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 31, 07:51 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

The Popup Builder plugin for WordPress (versions 4.4.5 and below) is affected by an authorization bypass vulnerability. The plugin fails to verify user authorization, enabling unauthenticated attackers to perform administrative actions. A secondary flaw in the 'SGPopup::find()' method causes the system to erroneously select all published popups when the 'sg_popup_preview_id' parameter is provided, resulting in the deletion of all site popups simultaneously.

Impact

Successful exploitation results in the unauthorized mass deletion of all published popups on the affected WordPress site, leading to potential service disruption and loss of marketing content.

Recommendation

  • Update the Popup Builder plugin to the latest secure version immediately.
  • Review WordPress access logs for anomalous GET requests containing the 'sg_popup_preview_id' parameter.
  • If the patch cannot be applied immediately, restrict access to the WordPress administrative interface and plugin-specific endpoints.

Immediate actions

Patch Popup Builder to the version addressing CVE-2026-89270

IT Operations 24h

Threat Hunt

Search for unexpected GET requests containing sg_popup_preview_id in web access logs

T1190 high high confidence hunt now

Data: Web server access logs (uri_query)

Mitigations

Upgrade Popup Builder plugin to version > 4.4.5

immediate IT Operations

CVE-2026-89270

Detection coverage 1

Detect CVE-2026-89270 Exploitation - Unauthenticated Popup Trashing

critical

Detects exploitation of CVE-2026-89270 by monitoring for GET requests containing the sg_popup_preview_id parameter targeting the plugin functionality.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →