# Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Popup Trashing

- **ID:** WPSEC-2026-1352
- **Plugin:** Popup Builder – Create highly converting, mobile friendly marketing popups. (`popup-builder`), https://wordpress.org/plugins/popup-builder/
- **Affected versions:** from 4.3.5 before 4.4.6
- **Fixed in:** 4.4.6 (Update to 4.4.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/popup-builder
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1352/

## Description

The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data in versions 4.3.5 through 4.4.5, due to a missing capability check in the active-popup query builder (getActivePopupsQueryString), which runs on every request, front end included, through the init hook and calls wp_trash_post() on any popup it fails to load. This makes it possible for unauthenticated attackers to move popups to the trash with a crafted URL. Adding the preview parameter makes every published popup that has no saved preview data fail to load, so those popups are trashed as well, not just popups whose popup type is disabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1352/
- https://plugins.svn.wordpress.org/popup-builder/tags/4.4.6/
- https://wordpress.org/plugins/popup-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1352/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.