WordPress security changelog
HIGH CVE-2026-18322 Deferred

Smart Popup permission collision permits unauthenticated administrator creation

Smart Popup by Supsystic through 1.12.0 merges controller permission maps in havePermissions() so that the popup module's administrator-only save restriction is overwritten. The unauthenticated wp_ajax_nopriv_save path accepts the generic pps_nonce included in a public subscription confirmation email and lacks a server-side role allowlist in createWpSubscriber(). An unauthenticated attacker who obtains that nonce can submit params[tpl][sub_wp_create_user_role]=administrator through popupControllerPps::save(), then trigger the saved confirmation flow to create a persistent administrator account with attacker-selected credentials.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Smart Popup by Supsystic
Plugin slug
popup-by-supsystic
Affected
<= 1.12.0
Safe version
> 1.12.0
Published
Aug 05, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Aug 05, 2026 and is one of 7 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Smart Popup by Supsystic to a release after 1.12.0. The authoritative record identifies 1.12.0 as affected and links a trunk correction, but does not identify the first fixed release. Until a fixed version is available, deactivate the plugin when warranted by the site's risk profile, and audit users and subscription-confirmation activity for unexpected administrator creation.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing `save` from protected actions; this is compounded by the subscription confirmation email embedding the same generic `pps_nonce` that the unauthenticated `wp_ajax_nopriv_save` endpoint accepts, and by the complete absence of any server-side role allowlist in `createWpSubscriber()`. This makes it possible for unauthenticated attackers to submit a crafted POST request to `admin-ajax.php` using a nonce obtained from a public subscription confirmation email, setting `params[tpl][sub_wp_create_user_role]` to `administrator` via the exposed `popupControllerPps::save()` action, and then triggering the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources