{"metadata": {"vulnerability": "CVE-2026-89270", "count": 21, "kinds": {"milestone": 4, "sighting": 7, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-11T11:01:45.127Z", "date_only": false, "value": "2026-09-11T11:01:45.127Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-89270", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-06T19:41:06Z", "date_only": false, "value": "2026-10-06T19:41:06.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-89270", "field": "containers.cna.timeline.0.time", "text": "Vendor Notified"}, {"timestamp": "2026-10-30T17:33:51Z", "date_only": false, "value": "2026-10-30T17:33:51.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-89270", "field": "containers.cna.timeline.1.time", "text": "Disclosed"}, {"timestamp": "2026-10-31T06:44:14.491Z", "date_only": false, "value": "2026-10-31T06:44:14.491Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89270", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-31T06:44:14.491Z", "date_only": false, "value": "2026-10-31T06:44:14.491Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-89270", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-31T07:08:02.371Z", "date_only": false, "value": "2026-10-31T07:08:02.371289Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117534260058463476", "record": "CVE-2026-89270", "field": "creation_timestamp", "uuid": "389deba5-a5c3-4c32-bf77-970e8c0335a8", "content": "CVE-2026-89270 Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters The Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.\nhttps://www.cve.org/CVERecord?id=CVE-2026-89270https://www.wordfence.com/threat-intel/vulnerabilities/id/13af3a6e-d3ef-41f0-9424-fe2c9b17c8bb?source=cvehttps://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1830https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L43https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L435https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L257https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1826https://wordpress.org/plugins/popup-builder/https://plugins.trac.wordpress.org/changeset/3755160/popup-builder/trunk/com/classes/popups/SGPopup.php#wordpress #popupbuilder #PopupBuilder\u2013Createhighlyconverting,mobilefriendlymarketingpopups.#CVE_2026_89270#bot", "url": "https://infosec.exchange/users/cve/statuses/117534260058463476"}, {"timestamp": "2026-10-31T07:16:37Z", "date_only": false, "value": "2026-10-31T07:16:37Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-94HG-GMRM-PPJJ", "record": "GHSA-94HG-GMRM-PPJJ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-31T07:16:37.707Z", "date_only": false, "value": "2026-10-31T07:16:37.707", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89270", "record": "FKIE_CVE-2026-89270", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T07:30:50.986Z", "date_only": false, "value": "2026-10-31T07:30:50.986699Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz5rm7to5t25", "record": "CVE-2026-89270", "field": "creation_timestamp", "uuid": "ac6617db-4384-477d-9bc6-9a31a1c6fab5", "content": "\ud83d\udd34 CVE-2026-89270 - Critical (9.1)\n\nThe Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin for Word...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-89270/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz5rm7to5t25"}, {"timestamp": "2026-10-31T08:07:15.574Z", "date_only": false, "value": "2026-10-31T08:07:15.574895Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/csx5wndmycvlp", "record": "CVE-2026-89270", "field": "creation_timestamp", "uuid": "926bd5f7-f6bf-44c7-a59b-79394c0f20c9", "content": "CVE-2026-89270 - Popup Builder\nCVE ID : CVE-2026-89270\n \n Published : Oct. 31, 2026, 7:16 a.m. | 16\u00a0minutes ago\n \n Description : The Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all ve...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/csx5wndmycvlp"}, {"timestamp": "2026-10-31T08:07:23.395Z", "date_only": false, "value": "2026-10-31T08:07:23.395407Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mz5tnkqqdh2z", "record": "CVE-2026-89270", "field": "creation_timestamp", "uuid": "dc65c301-3cc1-4014-8470-993374c52f71", "content": "\ud83d\udea8 CVE-2026-89270 \u2014 CVSS 9.1 CRITICAL\n\nThe Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin for WordPress is vul...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89270\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mz5tnkqqdh2z"}, {"timestamp": "2026-10-31T09:31:13Z", "date_only": false, "value": "2026-10-31T09:31:13Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-94HG-GMRM-PPJJ", "record": "GHSA-94HG-GMRM-PPJJ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T09:31:13Z", "date_only": false, "value": "2026-10-31T09:31:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-94HG-GMRM-PPJJ", "record": "GHSA-94HG-GMRM-PPJJ", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T00:00:17.486Z", "date_only": false, "value": "2026-11-01T00:00:17.486242Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mz7ivh77qg2t", "record": "CVE-2026-89270", "field": "creation_timestamp", "uuid": "27a602b6-909b-4ed6-a938-f9e0b20be122", "content": "CVE-2026-89270. CVSS 9.1. Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. lets unauthenticated attackers trash all your published content. No login needed. Update to 4.4.5 now. Scan your WordPress site: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mz7ivh77qg2t"}, {"timestamp": "2026-11-01T00:57:34.689Z", "date_only": false, "value": "2026-11-01T00:57:34.689046Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/ayiay34qzio62", "record": "CVE-2026-89270", "field": "creation_timestamp", "uuid": "6f05476f-45fc-48a8-8dda-a8732abfa647", "content": "\ud83d\udea8 CVE-2026-89270\nCVSS 9.1 / EPSS 0.39% / KEV: No\nTL;DR: The Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and\u2026\nhttps://cvesentinel.com/report/CVE-2026-89270\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/ayiay34qzio62"}, {"timestamp": "2026-11-01T01:40:04.299Z", "date_only": false, "value": "2026-11-01T01:40:04.299524Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz7ohve4p42f", "record": "CVE-2026-89270", "field": "creation_timestamp", "uuid": "f2ffb66e-f186-42fb-bac5-2163cd5ad573", "content": "CVE-2026-89270 - popup builder \u2013 create highly converting, mobile friendly marketing popups.\nThe Popup Builder plugin for WordPress (up to version 4.4.5) does not check who is making a request. As a result,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#popupbuilder #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz7ohve4p42f"}, {"timestamp": "2026-11-02T17:12:44.409Z", "date_only": false, "value": "2026-11-02T17:12:44.409365Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-89270", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-02T17:12:44.409Z", "date_only": false, "value": "2026-11-02T17:12:44.409365Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89270", "record": "FKIE_CVE-2026-89270", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-02T17:56:30.351Z", "date_only": false, "value": "2026-11-02T17:56:30.351Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-89270", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-02T17:56:30.351Z", "date_only": false, "value": "2026-11-02T17:56:30.351Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-89270", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-02T18:18:56.643Z", "date_only": false, "value": "2026-11-02T18:18:56.643", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89270", "record": "FKIE_CVE-2026-89270", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-07T14:32:01.351Z", "anchors": {"origin": {"timestamp": "2026-10-31T06:44:14.491Z", "date_only": false, "value": "2026-10-31T06:44:14.491Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89270", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-31T06:44:14.491Z", "date_only": false, "value": "2026-10-31T06:44:14.491Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89270", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 632866.860085, "hours": 175.79635002361113, "days": 7.324847917650463, "min_seconds": 632866.860085, "max_seconds": 632866.860085, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-31T06:44:14.491Z", "date_only": false, "value": "2026-10-31T06:44:14.491Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89270", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-07T14:32:01.351Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}