CVE-2026-112230 — Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter

CVE-2026-112230

Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter PUBLISHED

Description (CNA)

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

Affected (CNA)

Vendor / product	Versions
Unknown / Popup Builder	affected 0 before 4.4.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b5af802e-3667-41da-b543-b5e1bd7ba7ee/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.