WordPress Popup Builder Authorization Bypass Destroys Content

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Popup Builder plugin for WordPress contains a critical authorization bypass vulnerability (CVE-2026-89270, CVSS 9.1) that allows unauthenticated attackers to delete all published popups through a single GET request. The vulnerability stems from inadequate authorization checks in the plugin's core functions, combined with a secondary flaw in the SGPopup::find() method that fails to properly validate user permissions. This affects all versions up to 4.4.5 and impacts any WordPress site running this popular marketing plugin, threatening site availability, customer engagement, and business continuity for organizations relying on popup-based lead generation and conversion strategies.

Casky's security skills—leveraging Claude AI's extended reasoning across 283 mapped techniques—would detect attack patterns associated with TA0004 (Privilege Escalation) and TA0006 (Credential Access) by identifying unauthenticated HTTP GET requests targeting WordPress plugin endpoints that lack proper capability checks. Practitioners analyzing their findings would observe suspicious patterns such as requests to plugin action handlers without valid nonces, missing or bypassed user role validation checks, and direct database queries executed outside WordPress's permission framework. The skill set would flag the specific CWE-862 (Missing Authorization) indicators: absence of current_user_can() calls, improper use of wp_verify_nonce(), and direct AJAX handlers accessible to unauthenticated users. Detection would highlight the attack chain from unauthenticated access to unauthorized post deletion, enabling practitioners to prioritize patching and audit existing logs for exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-89270.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-89270

Casky has 283 skills that investigate the attack patterns behind CVE-2026-89270. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn