CVE-2026-112230 — Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated reques…
Published: 2026-10-23 · CVSS: 3.7 · CVSS 3.1
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7