CVE-2026-112230

UNKNOWN 0.0

Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

Vendor	unknown
Product	popup builder
Published	Oct 23, 2026

Stay Ahead of the Next One

Get instant alerts for unknown popup builder

Be the first to know when new unknown vulnerabilities affecting unknown popup builder are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Popup Builder

0 < 4.4.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/b5af802e-3667-41da-b543-b5e1bd7ba7ee/

Credits

Raphael P. Cigana WPScan