The Popup Builder WordPress plugin up to version 4.4.5 contains an authorization bypass vulnerability that allows unauthenticated attackers to trash all published popups with a single GET request. This is caused by improper authorization checks and is worsened by a logic flaw in the SGPopup::find() function, which triggers the trashing action on all popups when a specific parameter is present.