What is the CVSS score of CVE-2026-73381?

CVE-2026-73381 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Popup by Supsystic are affected by CVE-2026-73381?

Popup by Supsystic, a WordPress plugin used on potentially thousands of websites, contains a critical authentication flaw that lets attackers alter site functionality and configuration without…

How to fix or mitigate CVE-2026-73381?

Within 24 hours: audit all WordPress installations to identify systems running Popup by Supsystic plugin versions 1.13.0 or earlier using scanning tools or plugin inventory systems. Within 7 days: remove the plugin entirely from all affected systems (strongly recommended due to absence of vendor patch) or fully disable it if business-critical functionality cannot be immediately replaced; document all remediation actions. Within 30 days: implement alternative popup solutions where needed, deploy web application firewall rules to monitor for exploitation attempts against CVE-2026-73381, and establish a plugin management policy requiring regular audits and decommissioning of unsupported plugins.

Popup by Supsystic CVE-2026-73381

EUVD-2026-60796 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-18 Patchstack

GHSA-29w8-vv8g-hpgw

WordPress Information Disclosure Wordpress Plugin Popup By Supsystic Supsystic

9.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network AJAX/REST bypass (CWE-288) gives PR:N/AC:L; integrity and availability impact per broken auth, C:N absent confirmed disclosure despite the vendor tag.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 14:57 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

AnalysisAI

Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attackers bypass authentication controls to tamper with plugin state, per the CVSS 3.1 vector (I:H/A:H). Reported by Patchstack with a CVSS base score of 9.1; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Note the vendor tag labels it 'Information Disclosure' even though the CVSS vector sets C:N, a discrepancy defenders should verify.

Technical ContextAI

The affected component is Popup by Supsystic, a WordPress plugin used to build and display marketing/lead-capture popups, identified by CPE cpe:2.3:a:supsystic:popup_by_supsystic. The root cause class is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning a code path - commonly a WordPress AJAX action or REST endpoint that fails to enforce capability/nonce checks - can be reached without valid authentication. In WordPress plugins this typically manifests as an admin-intended handler registered on a wp_ajax_nopriv hook or lacking current_user_can()/check_ajax_referer() verification, allowing anonymous callers to invoke privileged functionality.

RemediationAI

No vendor-released patch version is confirmed in the available data; the affected range is <= 1.13.0, so upgrade to the next release above 1.13.0 once the vendor publishes it and confirm the fixed version via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/popup-by-supsystic/vulnerability/wordpress-popup-by-supsystic-plugin-1-13-0-broken-authentication-vulnerability). Until a fixed build is verified, compensating controls include deactivating the Popup by Supsystic plugin (trade-off: removes popup functionality site-wide), or placing a WAF rule / restricting access to the plugin's admin-ajax.php and REST endpoints to authenticated administrator sessions (trade-off: may break legitimate AJAX-driven popup rendering if the endpoint also serves front-end requests). Monitor plugin update channels and apply Patchstack virtual patching if subscribed.