CVE-2026-112230

Description

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

Traduire en français

Produits concernés

• Unknown Popup Builder

Références

• https://wpscan.com/vulnerability/b5af802e-3667-41da-b543-b5e1bd7ba7ee/

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories