What is the CVSS score of CVE-2026-18322?

CVE-2026-18322 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Smart Popup are affected by CVE-2026-18322?

The Smart Popup by Supsystic WordPress plugin (versions through 1.12.0) contains a critical privilege escalation vulnerability enabling unauthenticated attackers to create persistent administrator…

How to fix or mitigate CVE-2026-18322?

Within 24 hours: immediately deactivate and remove the Smart Popup by Supsystic plugin from all WordPress instances; audit WordPress user accounts for unauthorized administrator entries created in the past 90 days and delete them; rotate all WordPress administrative credentials. Within 7 days: implement Web Application Firewall rules blocking unauthenticated access to wp-admin-ajax.php with the 'save' action parameter; enable comprehensive WordPress admin action logging and monitor daily for suspicious user creation or privilege escalation events; scan for signs of compromise including unexpected plugins, themes, and user accounts. Within 30 days: identify and deploy alternative popup plugin solutions; conduct security assessment of all remaining WordPress plugins for similar vulnerabilities; establish mandatory security review process for all future plugin deployments.

Smart Popup CVE-2026-18322

EUVD-2026-53039 HIGH

Improper Privilege Management (CWE-269)

2026-08-05 Wordfence

GHSA-m4qm-m3w3-jjcg

PHP WordPress Privilege Escalation Wordpress Plugin Smart Popup By Supsystic Supsysticcom

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Subscription form is public; nonce retrieval requires no authentication, so PR:N is more accurate than the reported PR:L; all other metrics from the official vector are sound.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 05:55 vuln.today

CVE Published

Aug 05, 2026 - 04:25 cve.org

HIGH 8.8

DescriptionCVE.org

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions() function in classes/frame.php, where array_merge() overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing save from protected actions; this is compounded by the subscription confirmation email embedding the same generic pps_nonce that the unauthenticated wp_ajax_nopriv_save endpoint accepts, and by the complete absence of any server-side role allowlist in createWpSubscriber(). This makes it possible for unauthenticated attackers to submit a crafted POST request to admin-ajax.php using a nonce obtained from a public subscription confirmation email, setting params[tpl][sub_wp_create_user_role] to administrator via the exposed popupControllerPps::save() action, and then triggering the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials.

AnalysisAI

Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP array_merge() collision silently removes the save action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable pps_nonce that the wp_ajax_nopriv_save endpoint accepts, and createWpSubscriber() applies no server-side role allowlist - allowing an attacker to freely set params[tpl][sub_wp_create_user_role]=administrator. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.

Technical ContextAI

The affected component is the WordPress plugin popup-by-supsystic (CPE: cpe:2.3:a:supsysticcom:smart_popup_by_supsystic:*:*:*:*:*:*:*:*), a PHP plugin operating within the WordPress AJAX handler framework. The root cause class is CWE-269 (Improper Privilege Management), manifested across three code locations. First, classes/frame.php line 180 uses array_merge() to merge permission maps; because PHP's array_merge() renumbers integer-keyed arrays and overwrites string-keyed entries, the popup module's protected-methods array is silently replaced by the base controller's shallower list, removing the save method from the blocklist. Second, modules/subscribe/models/subscribe.php (lines 292, 358, 440) drives the subscriber confirmation flow and passes a generic pps_nonce into confirmation emails without scoping it to a specific action. Third, modules/popup/models/popup.php line 316 implements createWpSubscriber() without any WordPress capability check or role allowlist, accepting attacker-supplied role parameters verbatim via the exposed popupControllerPps::save() AJAX action registered on the wp_ajax_nopriv_save hook.

RemediationAI

Update the Smart Popup by Supsystic plugin to a version released after SVN changeset 3629986 once a tagged release is published; check the WordPress.org plugin page for the latest available version. The upstream fix modifies subscribe.php and should address the role allowlist gap in createWpSubscriber(). Until a confirmed patched release is available, apply the following compensating controls in priority order: disable the plugin entirely if popup subscriber signup forms are not business-critical (eliminates the exposed AJAX endpoint at zero other cost); if the plugin must remain active, use a WAF rule or Nginx/Apache rewrite to block unauthenticated POST requests to admin-ajax.php where the action parameter equals save and the action_module parameter equals popup (note: this may also block legitimate admin save operations and should be validated in a staging environment first); audit the WordPress wp_users table for any unexpected administrator-role accounts created after the plugin was installed. Refer to the Wordfence advisory for detection guidance.