CVE-2026-112230: Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter
Published Oct 23, 2026
·Updated
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Affected Software
1 affected component
Sygnoos Popup Builder<4.4.6
Event History
Oct 23, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness