low3.7
CVE-2026-112230
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unaut…
Impact
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Affected products
| Product | Affected versions |
|---|---|
| Popup Builder WordPress Plugin | before 4.4.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.