CVE-2026-73381— WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability
Possible ATT&CK Techniques 1AI
T1078.001 · Default AccountsGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-73381
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| supsystic | Popup by Supsystic | n/a ~ 1.13.0 | - |
II. Public POCs for CVE-2026-73381
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73381
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-73381 (1)
Same Patch Batch · supsystic · 2026-08-18 · 9 CVEs total
| CVE-2026-73376 | 9.8 CRITICAL | WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability |
| CVE-2026-73366 | 9.8 CRITICAL | WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability |
| CVE-2026-73380 | 9.8 CRITICAL | WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability |
| CVE-2026-73377 | 7.5 HIGH | WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability |
| CVE-2026-73367 | 7.2 HIGH | WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability |
| CVE-2026-73375 | 7.1 HIGH | WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerabi |
| CVE-2026-73378 | 7.1 HIGH | WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerabi |
| CVE-2026-73379 | 6.5 MEDIUM | WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability |
IV. Related Vulnerabilities
Same product: Popup by Supsystic
- CVE-2026-73380
WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object I - CVE-2026-27537
WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site S - CVE-2023-39997
WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Acce - CVE-2023-51353
WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Acce - CVE-2024-52434
WordPress Popup by Supsystic plugin <= 1.10.29 - Remote Code
Same vendor: supsystic
- CVE-2026-73380
WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object I - CVE-2026-73379
WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass - CVE-2026-73378
WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross - CVE-2026-73377
WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken - CVE-2026-73376
WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Ob
Same weakness: CWE-288
- CVE-2026-73399
WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken A - CVE-2026-73398
WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3. - CVE-2026-73396
WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Brok - CVE-2026-73379
WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass - CVE-2026-32481
WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vu
V. Comments for CVE-2026-73381
No comments yet