CVE-2026-89270

{
  "etk_id": "ETK-2026-3151",
  "cve_id": "CVE-2026-89270",
  "display_id": "CVE-2026-89270",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-114593",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Popup Builder",
  "summary": "Popup Builder for WordPress is affected through version 4.4.5. An unauthenticated attacker able to reach the site can cause published popups to be trashed, potentially removing all published popups from display.",
  "mitigation": "Disable Popup Builder on affected sites until the vendor provides a corrected release. If it must remain enabled, restrict untrusted access to the affected WordPress site and monitor popup status for unexpected changes.",
  "vendor": "popupbuilder",
  "product": "Popup Builder – Create highly converting, mobile friendly marketing popups.",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.4.5"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Popup Builder – Create highly converting, mobile friendly marketing popups.",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.2215183,
  "t0_at": "2026-10-31T06:44:14.491000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-31T07:01:01.718795+00:00",
      "days": 0.011657729108796297,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T06:44:14.491000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-31T06:44:14.491000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T06:44:14.491000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89270"
    }
  }
}