EUVD-2026-54200
GHSA-8x7c-xgmw-fg3x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trojanized code runs as trusted plugin with no auth or interaction and yields full site control, so PR:N/UI:N and C/I/A all High; scope kept Unchanged as impact stays within the WordPress instance.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.
AnalysisAI
Supply-chain compromise of the Supsystic Pro WordPress plugin family delivered trojanized plugin updates from the vendor's own compromised update server, giving unauthenticated attackers a foothold on every site that pulled the poisoned release. The embedded malicious code fetches a second-stage payload that harvests credentials and other sensitive data and hands the operator full control of the affected WordPress site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The concrete prerequisite is that the site installed or updated to a Supsystic Pro plugin version served from the vendor's update server during the compromise window - the malicious code arrives through the legitimate update mechanism, so the 'condition' is possession of the poisoned build rather than any attacker-side network position. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) accurately reflects the outcome - full confidentiality, integrity, and availability loss with no authentication or user interaction - but it under-describes the actual delivery: exploitation does not come from an attacker reaching an exposed network service, it comes from a site having installed a poisoned update, so the real precondition is 'ran the compromised Supsystic Pro version', not 'is reachable over the network'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified at time of analysis, and because this is a distribution-channel compromise rather than a code bug, simply 'updating' is not automatically safe until the vendor confirms a clean release served from a secured server - treat any Supsystic Pro update pulled during the compromise window as suspect. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress instances running Supsystic Pro; immediately disable and remove the plugin; scan systems for web shells and malicious processes; change all WordPress and database credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-912 – Hidden Functionality
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today