Popup Builder (<= 4.4.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/popup-builder--4.4.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 07:51:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPopup Builder: Authorization bypass and arbitrary popup deletion (CVE-2026-89270)https://feed.craftedsignal.io/briefs/2026-10-popup-builder-auth-bypass/Sat, 31 Oct 2026 07:51:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-popup-builder-auth-bypass/The Popup Builder WordPress plugin contains an authorization bypass vulnerability (CVE-2026-89270) that allows unauthenticated attackers to bulk delete published popups via a crafted GET request.The Popup Builder plugin for WordPress (versions 4.4.5 and below) is affected by an authorization bypass vulnerability. The plugin fails to verify user authorization, enabling unauthenticated attackers to perform administrative actions. A secondary flaw in the 'SGPopup::find()' method causes the system to erroneously select all published popups when the 'sg_popup_preview_id' parameter is provided, resulting in the deletion of all site popups simultaneously.

Impact

Successful exploitation results in the unauthorized mass deletion of all published popups on the affected WordPress site, leading to potential service disruption and loss of marketing content.

Recommendation

  • Update the Popup Builder plugin to the latest secure version immediately.
  • Review WordPress access logs for anomalous GET requests containing the 'sg_popup_preview_id' parameter.
  • If the patch cannot be applied immediately, restrict access to the WordPress administrative interface and plugin-specific endpoints.
]]>criticaladvisorywordpressvulnerabilitywebserver