Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Popup Trashing
- ID
- WPSEC-2026-1352
- Plugin
- Popup Builder – Create highly converting, mobile friendly marketing popups. (popup-builder)
- Affected
- from 4.3.5 before 4.4.6
- Remediation
- Update to 4.4.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- Popup Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data in versions 4.3.5 through 4.4.5, due to a missing capability check in the active-popup query builder (getActivePopupsQueryString), which runs on every request, front end included, through the init hook and calls wp_trash_post() on any popup it fails to load. This makes it possible for unauthenticated attackers to move popups to the trash with a crafted URL. Adding the preview parameter makes every published popup that has no saved preview data fail to load, so those popups are trashed as well, not just popups whose popup type is disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1352/
- https://plugins.svn.wordpress.org/popup-builder/tags/4.4.6/
- https://wordpress.org/plugins/popup-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS