Skip to content
Threat Feed
Subscribe

Product

Popup Builder (<= 4.4.5)

1 brief RSS
critical advisory

Popup Builder: Authorization bypass and arbitrary popup deletion (CVE-2026-89270)

The Popup Builder WordPress plugin contains an authorization bypass vulnerability (CVE-2026-89270) that allows unauthenticated attackers to bulk delete published popups via a crafted GET request.

Popup Builder wordpress vulnerability webserver
1r 1t 1c