CVE-2026-89270: Access control flaw in Popup Builder

Summary

An authorization bypass vulnerability, CVE-2026-89270, affects the Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress. This flaw impacts all plugin versions up to and including 4.4.5. A patch is available in version 4.4.6. There is no indication of active exploitation.

Affected and patched versions

• Popup Builder – Create highly converting, mobile friendly marketing popups. (plugin popup-builder): affected 4.4.5 and earlier; fixed in 4.4.6

Is my site vulnerable?

To determine if your WordPress site uses a vulnerable version of the Popup Builder plugin, follow these steps:

1. Log into your WordPress administration dashboard. This typically involves navigating to yourdomain.com/wp-admin and entering your credentials.

2. From the left-hand navigation menu, select "Plugins," then click on "Installed Plugins."

3. On the "Installed Plugins" page, locate the entry for "Popup Builder – Create highly converting, mobile friendly marketing popups."

4. Directly below the plugin's name, you will see its currently installed version number.

5. If the displayed version number is 4.4.5 or any earlier version, your site is exposed to this vulnerability. Version 4.4.6 contains the necessary security fixes.

Regularly checking and updating all plugins, themes, and the WordPress core installation is a fundamental security practice. This process helps ensure your site benefits from the latest security enhancements and vulnerability patches.

What an attacker actually does

This vulnerability, identified as CVE-2026-89270, involves an authorization bypass within the Popup Builder plugin. The core issue stems from the plugin's failure to properly verify if a user has the necessary permissions to perform certain actions. This lapse in authorization checking allows individuals who are not logged into the WordPress site—referred to as unauthenticated attackers—to execute actions typically reserved for authorized users.

Specifically, an unauthenticated attacker can send a single HTTP GET request to the vulnerable site. This request, crafted to target a specific plugin function, bypasses the normal security checks. Upon receiving this request, the plugin interprets it as a legitimate command to trash popups. The immediate consequence of this action is the removal of all published popups on the affected WordPress site. These popups are not permanently deleted but are moved to the trash, making them invisible to site visitors and disrupting any marketing or informational campaigns they support.

The impact of this attack is amplified by a second flaw found within the SGPopup::find() function of the plugin. When the sg_popup_preview_id parameter is present in the attacker's GET request, the SGPopup::find() function incorrectly returns a "false" value for every normally published popup on the site. This misinterpretation causes the plugin's internal "trash" logic to activate simultaneously against all existing popups. Instead of targeting a single popup, the attack effectively triggers a mass trashing event, leading to the immediate and widespread disappearance of all active popups across the entire website. This combined effect allows a simple, unauthenticated request to cause significant disruption by removing all active popups.

How to detect a compromise

Detecting a compromise related to CVE-2026-89270 primarily involves observing the state of your site's popups and reviewing administrative logs. The most direct indicator of a successful attack is the sudden and unexplained disappearance of all published popups from your website. If popups that were previously active and visible are no longer appearing, this suggests a potential compromise.

To investigate further within your WordPress environment:

1. Check the WordPress Admin Dashboard:

   • Log into your WordPress administration area.

   • Navigate to the "Popup Builder" section, typically found in the left-hand menu.

   • Look for a "Popups" or "All Popups" sub-menu.

   • Within this section, check for a filter option labeled "Trash" or similar. If you find a large number of popups listed under the "Trash" status that you did not intentionally move there, it indicates a compromise.

2. Use WP-CLI for Verification: If you have command-line access to your WordPress installation, you can use WP-CLI to quickly check for trashed popups. Execute the following command:

   wp post list --post_type=sg_popup --post_status=trash

   This command lists all posts with the custom post type sg_popup (which is used by the Popup Builder plugin) that are currently in the "trash" status. A significant number of results, especially for popups that were recently active, points to a compromise.

3. Review Server Access Logs: Examine your web server's access logs (e.g., Apache access.log, Nginx access.log). Look for unusual GET requests targeting plugin-specific endpoints, particularly those that might initiate actions without requiring authentication. While the exact request path will vary, look for patterns of unauthenticated requests that correspond to the time your popups disappeared. Pay attention to requests that include parameters like sg_popup_preview_id or other parameters that might trigger administrative actions.

4. Database Inspection: For a direct check, you can inspect your WordPress database. Access your database using a tool like phpMyAdmin or a command-line client. Look at the wp_posts table (replace wp_ with your actual table prefix if different). Filter entries where post_type is sg_popup and post_status is trash. The presence of numerous entries matching these criteria, especially if they were recently moved to trash, confirms the attack.

These detection methods help confirm if your site has been affected by this specific authorization bypass vulnerability.

How to fix

1. Update the Plugin: The primary remediation is to update the Popup Builder – Create highly converting, mobile friendly marketing popups. plugin to version 4.4.6 or higher. This version includes the necessary security fixes for CVE-2026-89270.

   • Log into your WordPress administration dashboard.

   • Navigate to "Plugins" -> "Installed Plugins."

   • Locate "Popup Builder – Create highly converting, mobile friendly marketing popups."

   • If an update is available, click the "Update Now" link beneath the plugin name.

   • If no update link is visible, and your version is 4.4.5 or earlier, manually update the plugin or consider temporarily deactivating it until you can update.

2. Restore Trashed Popups: If your popups were moved to trash due to an attack, you can restore them:

   • Go to "Popup Builder" -> "All Popups" in your WordPress admin.

   • Click on the "Trash" filter at the top of the list.

   • Select the popups you wish to restore.

   • Choose "Restore" from the "Bulk Actions" dropdown menu and click "Apply."

3. Review Site Security: After updating, review your site's overall security posture. Ensure all other plugins, themes, and your WordPress core are up to date. Implement strong passwords and consider using a security plugin for ongoing monitoring.

Timeline

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-89270

• https://www.wordfence.com/threat-intel/vulnerabilities/id/13af3a6e-d3ef-41f0-9424-fe2c9b17c8bb

• https://wordpress.org/plugins/popup-builder/

• https://www.cve.org/CVERecord?id=CVE-2026-89270

• https://sah.wordpress.org/plugins/popup-builder/