The Popup Builder WordPress plugin before 4.4.6 fails to perform authorization checks before executing its maintenance routine that moves popup content into the Trash. An attacker can exploit this flaw by sending unauthenticated requests to the routine and strategically providing the post_type parameter to target specific popups. The result is that affected popups are moved into the Trash and their preview data overwritten, leading to loss of content and configuration integrity on the site. The underlying weakness is an Authorization Bypass (CWE-862).

Any WordPress site running the Popup Builder plugin of version 4.4.5 or earlier is vulnerable. The vendor of the plugin is listed as Unknown in the CNA record, and the plugin is identified as "Popup Builder". No specific affected version list is provided beyond the pre‑4.4.6 threshold.

The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 3.7 reflects a low severity. However, the lack of authentication control and the fact that the vulnerable routine is invoked on unauthenticated requests make the attack likely to be straightforward. An attacker with knowledge of the site’s URL structure can trigger the trashing action without any credentials, resulting in irreversible loss of popup data.