The Popup Builder WordPress plugin before 4.4.6 fails to perform authorization checks before executing its maintenance routine that moves popup content into the Trash. An attacker can exploit this flaw by sending unauthenticated requests to the routine and strategically providing the post_type parameter to target specific popups. The result is that affected popups are moved into the Trash and their preview data overwritten, leading to loss of content and configuration integrity on the site.

Any WordPress site running the Popup Builder plugin of version 4.4.5 or earlier is vulnerable. The vendor of the plugin is listed as Unknown in the CNA record, and the plugin is identified as "Popup Builder". No specific affected version list is provided beyond the pre‑4.4.6 threshold.

There is no EPSS score available and the vulnerability is not listed in CISA's KEV catalog, indicating no publicly known exploitation at the time of this analysis. However, the lack of authentication control and the fact that the vulnerable routine is invoked on unauthenticated requests make the attack likely to be straightforward. An attacker with knowledge of the site’s URL structure can trigger the trashing action without any credentials, resulting in irreversible loss of popup data.