{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/sygnoos/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-89270"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Popup Builder (\u003c= 4.4.5)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","vulnerability","webserver"],"_cs_type":"advisory","_cs_vendors":["Sygnoos"],"content_html":"\u003cp\u003eThe Popup Builder plugin for WordPress (versions 4.4.5 and below) is affected by an authorization bypass vulnerability. The plugin fails to verify user authorization, enabling unauthenticated attackers to perform administrative actions. A secondary flaw in the 'SGPopup::find()' method causes the system to erroneously select all published popups when the 'sg_popup_preview_id' parameter is provided, resulting in the deletion of all site popups simultaneously.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized mass deletion of all published popups on the affected WordPress site, leading to potential service disruption and loss of marketing content.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Popup Builder plugin to the latest secure version immediately.\u003c/li\u003e\n\u003cli\u003eReview WordPress access logs for anomalous GET requests containing the 'sg_popup_preview_id' parameter.\u003c/li\u003e\n\u003cli\u003eIf the patch cannot be applied immediately, restrict access to the WordPress administrative interface and plugin-specific endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T07:51:10Z","date_published":"2026-10-31T07:51:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-popup-builder-auth-bypass/","summary":"The Popup Builder WordPress plugin contains an authorization bypass vulnerability (CVE-2026-89270) that allows unauthenticated attackers to bulk delete published popups via a crafted GET request.","title":"Popup Builder: Authorization bypass and arbitrary popup deletion (CVE-2026-89270)","url":"https://feed.craftedsignal.io/briefs/2026-10-popup-builder-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Sygnoos","version":"https://jsonfeed.org/version/1.1"}