What is the CVSS score of CVE-2026-73380?

CVE-2026-73380 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Popup by Supsystic are affected by CVE-2026-73380?

Popup by Supsystic WordPress plugin (versions 1.13.0 and earlier) contains a critical unauthenticated vulnerability allowing remote code execution on affected sites.

How to fix or mitigate CVE-2026-73380?

Within 24 hours: immediately remove Popup by Supsystic from all WordPress installations and audit server access logs for suspicious activity. Within 7 days: deploy a replacement popup solution and configure Web Application Firewall rules to block requests containing serialized PHP objects to minimize residual risk. Within 30 days: audit all WordPress plugins and themes for similar object injection flaws, establish a plugin update monitoring process to catch future critical vulnerabilities, and transition to a hardened WordPress security baseline.

Popup by Supsystic CVE-2026-73380

EUVD-2026-60795 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-18 Patchstack

GHSA-66gj-6m2v-rp63

PHP WordPress Deserialization Wordpress Plugin Popup By Supsystic Supsystic

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, network-reachable, no user interaction (PR:N/UI:N/AV:N/AC:L); high C/I/A reflects potential full compromise via a deserialization POP chain, matching worst-case object-injection impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 14:57 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the WordPress plugin Popup by Supsystic (versions 1.13.0 and earlier) lets remote attackers submit crafted serialized data that the plugin deserializes without validation. Reported by Patchstack and rated CVSS 9.8, the flaw is exploitable without authentication or user interaction; if a suitable POP gadget chain is present in the WordPress core, another plugin, or theme, it can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-502, Deserialization of Untrusted Data. In PHP, calling unserialize() on attacker-controlled input instantiates arbitrary objects and triggers their magic methods (__wakeup, __destruct, __toString), which an attacker can abuse by chaining existing classes ('gadgets') already loaded in the WordPress runtime into a Property-Oriented Programming (POP) chain. The affected component per the CPE is cpe:2.3:a:supsystic:popup_by_supsystic (all versions through 1.13.0), a popup/modal plugin for WordPress. PHP Object Injection itself does not execute code directly; its practical impact depends on the gadget chains reachable in the target's specific WordPress core, plugin, and theme stack.

RemediationAI

Upgrade Popup by Supsystic to the first release above 1.13.0 that addresses this issue; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/popup-by-supsystic/vulnerability/wordpress-popup-by-supsystic-plugin-1-13-0-php-object-injection-vulnerability) is the reference for the fixed version, which is not independently confirmed in the provided data - verify the exact patched version on the WordPress.org plugin page before deploying. If an update cannot be applied immediately, deactivate and remove the plugin (removes the popup functionality but eliminates the deserialization sink), or place a WAF/virtual patch in front of the site to block requests carrying serialized PHP payloads (regex matching on 'O:' object markers can produce false positives on legitimate serialized fields, so tune carefully). As defense in depth, disable unused plugins and themes to shrink the available POP gadget surface, since that surface determines whether object injection is exploitable.