CVE-2026-18322 supsysticcom CVE debrief

Who should care

Administrators of WordPress sites using the Smart Popup by Supsystic plugin, especially those with versions up to and including 1.12.0, should be aware of this vulnerability and take immediate action to update or mitigate the risk.

Technical summary

The Smart Popup by Supsystic plugin for WordPress, versions up to and including 1.12.0, is vulnerable to Privilege Escalation. This vulnerability stems from a permission map collision in the `havePermissions()` function within `classes/frame.php`, where `array_merge()` overwrites the popup module's administrator-restricted method list with the base controller's value. This overwrite silently removes `save` from protected actions. The issue is compounded by the subscription confirmation email embedding the same generic `pps_nonce` that the unauthenticated `wp_ajax_nopriv_save` endpoint accepts, and by the complete absence of any server-side role allowlist in `createWpSubscriber()`. Consequently, unauthenticated attackers can submit a crafted POST request to `admin-ajax.php` using a nonce obtained from a public subscription confirmation email. By setting `params[tpl][sub_wp_create_user_role]` to `administrator` via the exposed `popupControllerPps::save()` action, attackers can trigger the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials. Affected product deployments should review and apply updates or mitigations through normal change control. Compensating controls, such as restricting access to the `admin-ajax.php` endpoint and monitoring for suspicious subscription confirmation emails and nonce usage, should be considered while remediation is scheduled and verified. Additional logging and monitoring for administrator account creations are also recommended to detect potential exploitation attempts. The vulnerability's impact can be mitigated by implementing these defensive measures, and it is crucial for administrators of WordPress sites using the Smart Popup by Supsystic plugin to be aware of this vulnerability and take immediate action to update or mitigate the risk effectively. Evidence of the vulnerability includes the permission map collision in the `havePermissions()` function and the absence of server-side role allowlisting, as detailed in the analysis of the Smart Popup by Supsystic plugin for WordPress, specifically versions up to and including 1.12.0. To address this vulnerability, it is of

Defensive priority

High priority should be given to updating the Smart Popup by Supsystic plugin to a version beyond 1.12.0, as the vulnerability allows for privilege escalation, potentially leading to unauthorized administrator account creation.

Recommended defensive actions

• Update the Smart Popup by Supsystic plugin to a version beyond 1.12.0.
• Restrict access to the `admin-ajax.php` endpoint.
• Monitor for suspicious subscription confirmation emails and nonce usage.
• Implement additional logging and monitoring for administrator account creations.
• Verify that compensating controls are in place for exposed systems while remediation is scheduled.
• Review and document exceptions for retesting remediated assets.
• Track changes to the environment and verify that updates have been applied correctly.

Evidence notes

The vulnerability details are based on the analysis of the Smart Popup by Supsystic plugin for WordPress, specifically versions up to and including 1.12.0. Evidence includes permission map collision in the `havePermissions()` function and the absence of server-side role allowlisting.

Official resources