Smart Popup CVE-2026-18322

The plugin must be installed and active on a WordPress site, and at least one popup with a subscriber opt-in form must be published and accessible to unauthenticated visitors - this is the standard use case the plugin is designed for, making it effectively a default-configuration issue for any site using the subscription feature. The attacker must be able to receive email at the address submitted to the subscription form in order to obtain the pps_nonce from the confirmation email; this is the sole gating condition. The wp_ajax_nopriv_save AJAX hook must remain registered, which is the case for all versions through 1.12.0. Exploitation is not limited to a specific platform, hosting configuration, or WordPress version. What limits exploitation: the attacker must control an email inbox to receive the confirmation nonce; automated, purely network-based exploitation without an email step is not possible. Sites that have disabled subscriber opt-in forms across all popups are not exploitable via this specific chain.

The NVD CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is broadly accurate but the PR:L designation warrants scrutiny. The description explicitly characterises the attacker as unauthenticated; the only prerequisite is submitting a subscription form - a fully public action - to harvest a pps_nonce from the resulting email. This is not a meaningful privilege barrier and argues for PR:N rather than PR:L. Attack complexity is genuinely Low: the nonce is embedded in a standard email, the POST structure is documented in the source, and no race condition or specialised tooling is needed. The absence of a CISA KEV listing and no confirmed public POC at time of analysis moderates urgency compared to a KEV-listed peer, but the technical prerequisites are minimal and the impact - full WordPress site takeover via a new admin account - is maximal. EPSS data was not supplied; given low complexity and high impact the exploitation probability should be considered elevated once the vulnerability becomes widely known. Any site running this plugin with subscriber signup forms exposed to the internet is at material risk.

An attacker visits a WordPress site running Smart Popup by Supsystic with a visible subscriber opt-in popup, submits their email address to trigger the subscription confirmation flow, and harvests the pps_nonce value embedded in the resulting confirmation email. They then send a crafted POST request to https://[target]/wp-admin/admin-ajax.php with action=save, action_module=popup, the harvested nonce, and params[tpl][sub_wp_create_user_role]=administrator alongside attacker-chosen username and password fields. Because the permission collision has silently removed save from the blocklist and createWpSubscriber() applies no role validation, the request executes without error and creates a fully privileged administrator account, giving the attacker complete control over the WordPress installation.