Smart Popup EUVD-2026-111973

Requires an authenticated WordPress administrator account on a site running Smart Popup by Supsystic before version 2.0.2 (PR:H). The attacker must be able to create or edit a popup and insert a template-injection payload into a popup text block; successful evaluation depends on the plugin's ordering flaw where the delimiter-stripping filter runs before the decoding step that reconstructs the template delimiters, so a plainly-delimited payload would be stripped - the payload must be encoded such that decoding re-forms the delimiters after filtering. The primary limiting factor is the administrator privilege requirement, which confines exploitation to trusted/insider admins or a hijacked admin session rather than unauthenticated remote attackers; no victim user interaction is required (UI:N).

This is a high-CVSS-component but moderate-real-risk issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N → 4.9) is internally consistent with the description: the attack is over the network against the WordPress admin interface (AV:N), is low-complexity (AC:L), requires no victim interaction (UI:N), and the PR:H reflects that only an authenticated administrator can reach the vulnerable popup text block. Impact is confidentiality-only (C:H, I:N, A:N), matching the described outcome of reading PHP constants such as database credentials and authentication keys via server-side template evaluation. The dominant mitigating signal is PR:H: an attacker must already hold administrator access, which sharply narrows the realistic threat to insider/least-privilege-escalation scenarios or a compromised admin account rather than opportunistic external attack. There is no EPSS score, no KEV listing, and no SSVC exploitation data in the input, so widespread-exploitation probability cannot be quantified from this data. A PoC reference exists (WPScan) but is not verified as working exploit code, and the vuln.today decision label is 'this_month' - a scheduled-remediation priority, not an emergency. Net: patch within the normal cycle; the admin-only barrier keeps this well below drop-everything urgency, but the ability to exfiltrate DB credentials and auth keys makes it meaningful where admin accounts are not fully trusted.

An authenticated administrator (or an attacker who has compromised an admin account) stores a template-injection payload inside a Smart Popup text block; because the delimiter-stripping filter runs before the decoding step that reconstructs the delimiters, the payload survives into the template engine and is evaluated server-side. The attacker uses this to read PHP constants and exfiltrate the site's database credentials and authentication keys. A public PoC reference exists (WPScan) but it is not verified as working exploit code.