External risk intelligence

Popup Builder WordPress Plugin Authorization Bypass Affects All Versions Up To 4.4.5

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-89270

This vulnerability affects a WordPress plugin designed for public-facing marketing popups. Because the plugin is intended to be used on public-facing websites and the attack vector is a standard HTTP GET request, it is highly probable that the vulnerable functionality is reachable via the public internet in common deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Popup Builder WordPress plugin, allowing unauthenticated attackers to delete all published popups on a site with a single request. This issue stems from the plugin's failure to properly verify user authorization for certain actions.

Unauthenticated attackers can trash all published popups.
Critical flaw impacts a widely used WordPress marketing tool.
Confirm relevance and exposure of this marketing plugin.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can bypass authorization checks in the Popup Builder WordPress plugin to delete all published popups. This is achieved by sending a specific GET request that exploits a flaw in how the plugin handles popup previews, causing it to mistakenly target all popups for deletion.

No login required to attack.
Triggered by a crafted GET request.
Can delete all published popups.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow unauthenticated attackers to remove all published marketing popups from a WordPress site. This is possible because the plugin may not properly check if a user is authorized to perform certain actions, potentially leading to widespread disruption of website content.

All published popups at risk.
Unauthenticated GET request exposes the flaw.
Disrupts website content delivery.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress plugin, Popup Builder, is vulnerable to an authorization bypass that allows unauthenticated attackers to delete all published popups. This critical vulnerability, affecting all versions up to and including 4.4.5, requires immediate attention. Website owners and administrators should prioritize identifying all instances of this plugin, verifying its reachability and business criticality, and coordinating with the application owner to plan remediation.

WordPress site owners/administrators should own this issue.
Verify plugin instances and exposure to public networks.
Plan immediate vendor-coordinated remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Popup Builder plugin for WordPress?

Popup Builder is a widely used software extension for WordPress designed to help site owners create and manage marketing popups. These popups are typically used to capture leads, announce promotions, or display messages to visitors on public-facing websites.

What does authorization bypass mean for CVE-2026-89270?

This vulnerability, classified as CWE-862, occurs when software fails to verify if a user has permission to perform an action. In this case, the plugin does not check for user credentials, allowing someone without an account to execute administrative functions, specifically deleting published popups.

How is this vulnerability triggered?

An attacker triggers this by sending a single, specifically crafted GET request to the site. The attack relies on an error in how the plugin handles popup previews; it inadvertently treats this request as an instruction to trash every published popup on the site simultaneously.

Is my site at risk if I use this plugin?

According to Halo Surface Signal, this vulnerability is highly relevant for most users. Because Popup Builder is designed for public-facing marketing, and the attack requires only a standard web request, the vulnerable functionality is likely reachable via the public internet on common installations.

What should I do if I run this plugin?

You should immediately identify all instances of the Popup Builder plugin within your WordPress environment. Verify if the plugin is active and accessible via the internet, then coordinate with your team to apply the necessary updates or patches provided by the vendor to remediate the flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.