Popup Builder CVE-2026-112230

Exploitation requires the target to run Popup Builder before version 4.4.6, where a maintenance routine that trashes popup content is reachable via unauthenticated requests and performs no authorization check (CWE-862). It is network-reachable with no authentication and no user interaction (AV:N/PR:N/UI:N), but the high attack complexity (AC:H) indicates the trash routine's trigger conditions are not fully under the attacker's control, limiting reliable exploitation. Impact is confined to moving affected popups into the Trash and overwriting their stored preview data (integrity-only); there is no confidentiality or availability impact and no code execution. Updating to 4.4.6 removes the issue.

All decision signals point to this being a low-priority issue rather than an urgent one. The CVSS 3.1 base score is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N: although it is network-reachable and unauthenticated (PR:N), the high attack complexity (AC:H) and integrity-only, low impact (C:N/I:L/A:N) cap its severity. The vuln.today Decision label is 'monitor', and the CISA SSVC framework records Exploitation: none, Automatable: no, Technical Impact: partial - a mutually consistent set of low-urgency indicators. No EPSS exploitation-probability score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; this is a data gap, not evidence of either high or low likelihood. The CVE is not listed in CISA KEV, and the input provides no PoC or exploit-code reference (only a WPScan advisory and the NVD detail page). There is no conflict among the available signals: low CVSS, SSVC exploitation=none, and 'monitor' all agree this is a genuinely low-real-risk, authorization-missing defect whose only outcome is moving popups to Trash and overwriting preview data, not code execution or data disclosure.

An attacker sends an unauthenticated HTTP request to the WordPress site that reaches the Popup Builder maintenance routine, which trashes popup content without checking authorization. Because the affected integrity impact is limited to moving popups into the Trash and overwriting their stored preview data, the result is nuisance-level content disruption rather than site compromise. No public exploit identified at time of analysis; the high attack complexity (AC:H) indicates the trigger is not fully attacker-controlled.