CVE-2026-112230: CWE-862 Missing Authorization in Popup Builder
Description
A vulnerability in the Popup Builder WordPress plugin before version 4.4.6 allows unauthenticated attackers to move popup content into the Trash and overwrite stored preview data. This occurs because the plugin does not perform authorization checks during a maintenance routine triggered by unauthenticated requests.
Affected software
Popup Builder
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-112230 is a missing authorization vulnerability (CWE-862) in the Popup Builder WordPress plugin versions prior to 4.4.6. The plugin's maintenance routine, which can be triggered without authentication, fails to verify user permissions before trashing popup content. This flaw enables unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data, potentially disrupting popup functionality or content management.
Potential Impact
Unauthenticated attackers can cause denial of service to popup content by moving it to the Trash and overwriting preview data. This may disrupt website user experience or marketing efforts relying on popups. There is no indication of data disclosure or remote code execution from the provided information.
Mitigation Recommendations
Upgrade the Popup Builder plugin to version 4.4.6 or later, where authorization checks have been implemented to prevent unauthorized trashing of popup content. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-19T11:11:58.946Z
- State
- PUBLISHED
Threat ID: 6adafb9a4d27ba8daad7778e
Added to database: 10/23/2026, 06:15:54 UTC
Last enriched: 10/23/2026, 06:30:49 UTC
Last updated: 10/23/2026, 06:35:24 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.