An authorization bypass vulnerability in the Popup Builder plugin allows unauthenticated attackers to trash all published popups on a WordPress site.
Affected component: Popup Builder – Create highly converting, mobile friendly marketing popups. (plugin)
Fixed in: 4.4.6
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since November 1, 2026. No PowerSEC firewall rule blocks this attack. Update to 4.4.6 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-89270