CVE-2026-112230 Popup Builder CVE debrief

Who should care

Defenders responsible for WordPress installations with the Popup Builder plugin should assess exposure and prioritize updates to prevent unauthorized popup trashing. This includes verifying and updating plugin versions, implementing authorization checks, and monitoring for unauthorized attempts. Security teams and vulnerability management teams should review and address this vulnerability to prevent potential overwriting of stored preview data.

Why it matters

CVE-2026-112230 allows unauthenticated attackers to trash popups in the Popup Builder plugin before version 4.4.6, potentially overwriting stored preview data. Defenders should prioritize verifying and updating plugin versions, implementing authorization checks, and monitoring for unauthorized attempts.

• Verify and update Popup Builder plugin versions to prevent unauthorized popup trashing
• Implement authorization checks for popup trashing to prevent overwriting stored preview data

Technical summary

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data. This vulnerability affects WordPress installations with the Popup Builder plugin, potentially allowing attackers to overwrite stored preview data. Defenders should prioritize verifying and updating plugin versions to prevent unauthorized popup trashing.

Defensive priority

Defenders should prioritize verifying and updating Popup Builder plugin versions to prevent unauthorized popup trashing.

Recommended defensive actions

• Verify and update Popup Builder plugin versions to 4.4.6 or later
• Implement authorization checks for popup trashing
• Monitor for unauthorized popup trashing attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in Popup Builder plugin before version 4.4.6. The vulnerability allows unauthenticated attackers to trash popups and potentially overwrite stored preview data. Defenders should verify and update plugin versions to prevent unauthorized popup trashing. The source item and CVE record provide evidence of the vulnerability, but additional verification is necessary to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.