CVE-2026-18322
Received Received - Intake

Privilege Escalation in Smart Popup by Supsystic WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing `save` from protected actions; this is compounded by the subscription confirmation email embedding the same generic `pps_nonce` that the unauthenticated `wp_ajax_nopriv_save` endpoint accepts, and by the complete absence of any server-side role allowlist in `createWpSubscriber()`. This makes it possible for unauthenticated attackers to submit a crafted POST request to `admin-ajax.php` using a nonce obtained from a public subscription confirmation email, setting `params[tpl][sub_wp_create_user_role]` to `administrator` via the exposed `popupControllerPps::save()` action, and then triggering the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-18322
EUVD
EUVD-2026-53039

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
supsystic smart_popup to 1.12.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Smart Popup by Supsystic WordPress plugin up to version 1.12.0 has a privilege escalation flaw. The vulnerability occurs because the plugin's permission system incorrectly merges administrator-restricted actions, removing critical protections. Attackers can exploit this by sending a crafted request to create a WordPress admin account without authentication.

Detection Guidance

Check WordPress sites for the Smart Popup by Supsystic plugin version 1.12.0 or lower. Inspect admin-ajax.php POST requests for unauthorized role escalation attempts, particularly those setting params[tpl][sub_wp_create_user_role] to administrator. Review user accounts for unexpected administrator-level users created without authorization.

Impact Analysis

Unauthenticated attackers can gain full control of a WordPress site by creating an admin account. This allows them to install malicious plugins, steal data, deface the site, or take over the entire server. The attack is possible even without user interaction by exploiting a nonce from a subscription email.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for access control and data protection. Organizations using this plugin may face compliance violations, fines, and reputational damage if exploited.

Mitigation Strategies

Immediately update the Smart Popup by Supsystic plugin to the latest version if available. Remove the plugin if no update exists. Audit all WordPress user accounts for unauthorized administrator accounts and remove them. Monitor admin-ajax.php POST requests for suspicious activity targeting this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18322. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart