CVE-2026-18322 PUBLISHED

Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator

Assigner: Wordfence
Reserved: 29.07.2026 Published: 05.08.2026 Updated: 05.08.2026

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions() function in classes/frame.php, where array_merge() overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing save from protected actions; this is compounded by the subscription confirmation email embedding the same generic pps_nonce that the unauthenticated wp_ajax_nopriv_save endpoint accepts, and by the complete absence of any server-side role allowlist in createWpSubscriber(). This makes it possible for unauthenticated attackers to submit a crafted POST request to admin-ajax.php using a nonce obtained from a public subscription confirmation email, setting params[tpl][sub_wp_create_user_role] to administrator via the exposed popupControllerPps::save() action, and then triggering the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor supsysticcom
Product Smart Popup by Supsystic
Versions Default: unaffected
  • affected from 0 to 1.12.0 (incl.)

Credits

  • daroo finder

References

Problem Types

  • CWE-269 Improper Privilege Management CWE