Authorization Bypass Vulnerability in Popup Builder Plugin for WordPress

CVE-2026-89270

What is CVE-2026-89270?

The Popup Builder plugin for WordPress is susceptible to an authorization bypass, allowing unauthenticated attackers to delete all published popups. This vulnerability arises from the plugin's failure to properly verify user permissions before executing actions. An additional flaw in the SGPopup::find() function exacerbates the issue by returning false for all normally published popups when the sg_popup_preview_id parameter is included, enabling an attacker to target multiple popups at once through a single unauthenticated GET request. This poses a significant threat to site integrity and content management.

References