The Popup Builder plugin for WordPress suffers from an authorization bypass that allows any unauthenticated user to issue a GET request that triggers the trashing of all published popups. Because the plugin fails to verify the user's privileges before performing delete operations, an attacker can instantly remove every popup on the site. The vulnerability also exploits a secondary flaw in the SGPopup::find() method, which returns false for normally published popups when the sg_popup_preview_id parameter is present, forcing the trash logic to execute against each popup and amplifying the impact. The result is a wholesale loss of marketing popups, which can disrupt revenue‑generating mechanisms and alter site appearance.

All installations of the Popup Builder plugin for WordPress, version 4.4.5 and earlier. No auxiliary versions are explicitly listed, so any deployment using version 4.4.5 or older is potentially vulnerable.

The CVSS score of 9.1 indicates high severity. Because the flaw can be exploited with a simple unauthenticated GET request and no authentication barrier, the risk is high. The EPSS score is not available, but the lack of restrictions and the amplification bug make exploitation likely. The vulnerability is not part of the CISA KEV catalog, yet the absence of a patch until a newer release necessitates urgent action. Attackers only need network visibility to the site and can trigger the deletion with no credentials.