CVE-2026-89270: Popup Builder Plugin Auth Bypass (9.1)

A critical vulnerability, tracked as CVE-2026-89270, affects the Popup Builder WordPress plugin in all versions up to and including 4.4.5. According to the GitHub Advisory Database entry, an unauthenticated attacker can trash all published popups on a site with a single GET request. The issue is rated 9.1 (critical) on the CVSS v3 scale.

If you run WordPress sites that use Popup Builder for promotions, email capture, cookie notices or announcements, this one is relevant to you. The advisory describes damage to site content and availability of popups, not data theft, but popups often carry revenue-relevant messages, so it is worth acting on quickly.

What happened

The advisory was published on October 31, 2026, by the National Vulnerability Database and mirrored in the GitHub Advisory Database. It describes an authorization bypass: the plugin does not properly verify that a user is allowed to perform an action. The result is that someone with no account on the site can trigger the action of moving popups to the trash.

The advisory also describes a second flaw that amplifies the effect. In a function called SGPopup::find(), the lookup returns false for every normally published popup when a particular preview parameter (sg_popup_preview_id) is present. That causes the trash branch of the code to run against every popup on the site at once, rather than a single one.

Technical details

The weakness class is CWE-862, Missing Authorization. In plain terms, the code performs a sensitive action (changing a popup's status to trash) without first asking whether the requester is logged in or has permission. Authentication and authorization checks are what normally separate a site administrator from an anonymous visitor, and here that check is described as absent.

The vector reads as: reachable over the network, low complexity, no privileges, no user interaction, with high impact on integrity and availability and none on confidentiality. That matches the described behavior: popups are altered or removed and stop displaying, but nothing in the advisory suggests information is disclosed.

The advisory links to specific lines in the plugin's 4.4.5 source on the WordPress.org Trac, along with a Trac changeset touching SGPopup.php. The advisory does not say whether that changeset is the official fix or which release contains it, so do not assume a specific version is safe on that basis alone.

Who is affected

Any WordPress site with the Popup Builder plugin installed and active at version 4.4.5 or earlier is within the affected range. Because no login is required, the exposure does not depend on how many users or roles your site has. Agencies and hosts managing many client sites should treat this as a fleet-wide check.

Realistic impact, based on the description: popups that run lead capture, discount offers, age gates, consent messages or announcements could disappear from the site until someone restores them. Trashed items in WordPress are typically recoverable from the trash until it is emptied, but you should verify this on your own site rather than rely on it.

How to check your exposure

1. Log in to the WordPress admin and open the Plugins page. Find Popup Builder and note the installed version.
2. If the version is 4.4.5 or lower, treat the site as affected.
3. Open the Popup Builder list in the admin and look at the Trash view. A sudden batch of trashed popups you did not remove is a warning sign.
4. Check your web server access logs for unusual GET requests containing the sg_popup_preview_id parameter, especially from unfamiliar IP addresses or in large bursts.
5. Compare what visitors see on the front end with what you expect. Missing popups are an early symptom.

You can also look up the plugin on our known WordPress plugin vulnerabilities page, and our guide on checking whether a WordPress plugin is vulnerable walks through the process.

What to do now

The advisory does not name a patched release, so the first step is to check the plugin's official page on WordPress.org and the vendor's changelog for a version newer than 4.4.5 that addresses CVE-2026-89270. If one is available, update after taking a backup.

• Back up the site and database before updating any plugin.
• Update Popup Builder to a release newer than 4.4.5 once the changelog confirms it addresses this issue.
• If no fixed release is available yet, consider deactivating the plugin until one is, especially on sites where popups are business-critical or where you cannot monitor closely.
• Restore any popups that were trashed from the Popup Builder trash view, then confirm they display correctly.
• Rate-limit or filter requests that include the sg_popup_preview_id parameter at your web server or firewall as a temporary measure, and test that legitimate previews still work for your editors.
• Review the rest of your plugin list and remove plugins you no longer use.

A website firewall can add a layer of filtering for suspicious requests, as described in our explainer on what a WAF is, but it is a mitigation and not a substitute for updating the plugin. Our WordPress security checklist covers broader hardening.

Detection and monitoring afterwards

Because the impact is on popup content, the simplest monitor is a human-readable one: keep a short list of the popups that should appear on key pages and check them after any plugin change. For larger setups, schedule a periodic check of the Popup Builder trash count and review web server logs for the parameter mentioned above.

Uptime and change monitoring can help you notice when pages stop behaving as expected. Webforta Monitor tracks uptime, certificates, DNS and header changes, which is useful general hygiene, though it does not look inside your popup configuration.

What we do not know yet

• Which version, if any, contains the fix.
• Whether the flaw is being exploited in the wild. The research does not report exploitation.
• Whether the vendor has published its own advisory or statement.
• Who discovered and reported the issue. The advisory entry does not say.

We will treat this as an evolving story. Until a fixed version is confirmed, plan around the affected range of 4.4.5 and earlier.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

• CVE-2026-89270 - GitHub Advisory Database (github.com)
• CVE-2026-89270: The Popup Builder – Create highly converting, mobile friendly marketing popups. (nvd.nist.gov, 31 October 2026)

Tags: WordPress, Popup Builder, CVE-2026-89270, authorization bypass, plugin security