Smart Popup <= 1.12.0 Unauthenticated Privilege Escalation (CVE-2026-18322)

Vulnerability Overview Vulnerability Name: Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator CVE ID: CVE-2026-18322 CVSS Score: 8.8 (High) Release Date: April 4, 2026 Last Updated: August 5, 2026 Researcher: daroo Affected Versions Affected Versions: <= 1.12.0 Software Type: Plugin Software Name: Smart Popup by Supsystic Software Slug: popup-by-supsystic Remediation Fixed Version: 1.13.0 Remediation Advice: Update to version 1.13.0 or higher Vulnerability Description The Smart Popup by Supsystic plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to 1.12.0. This vulnerability arises from a permissions mapping conflict within the function, where overwrites the list of admin-restricted methods, removing the protected status of . Additionally, the subscription confirmation email embeds a generic , and the endpoint accepts unauthenticated requests. Combined with the lack of a server-side role allowlist in , this allows an unauthenticated attacker to construct a POST request using the nonce obtained from the public subscription confirmation email to submit to , set to , and trigger the stored confirmation process via the exposed action. This enables the creation of a persistent WordPress administrator account with attacker-chosen credentials. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Vulnerability Details Software Type: Plugin Software Name: Smart Popup by Supsystic Software Slug: popup-by-supsystic Patched: Yes Remediation Advice: Update to version 1.13.0 or higher Affected Versions: <= 1.12.0 Fixed Version: 1.13.0 Recent Vulnerabilities Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X Facebook Instagram YouTube Subscribe Subscription Form: Sign Up Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe to Updates Subscription Form: Sign Up Other Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X Facebook Instagram YouTube Subscribe Subscription Form: Sign Up Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe to Updates Subscription Form: Sign Up Other Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X Facebook Instagram YouTube Subscribe Subscription Form: Sign Up Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe to Updates Subscription Form: Sign Up Other Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X Facebook Instagram YouTube Subscribe Subscription Form: Sign Up Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About

Goal Reached Thanks to every supporter — we hit 100%!

Smart Popup <= 1.12.0 Unauthenticated Privilege Escalation (CVE-2026-18322)

More from this source