Supsystic Pro EUVD-2026-54200

The concrete prerequisite is that the site installed or updated to a Supsystic Pro plugin version served from the vendor's update server during the compromise window - the malicious code arrives through the legitimate update mechanism, so the 'condition' is possession of the poisoned build rather than any attacker-side network position. What limits exploitation: only sites running the affected Supsystic Pro plugins (paid Pro editions) during that window are impacted, so sites that never installed Pro or that pinned to a version predating the compromise are unaffected. Once the poisoned version is present, exploitation is unauthenticated and needs no further victim interaction (consistent with PR:N/UI:N). The exact affected version range and compromise window are not specified in the available data and must be taken from the WPScan/vendor advisory.

The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) accurately reflects the outcome - full confidentiality, integrity, and availability loss with no authentication or user interaction - but it under-describes the actual delivery: exploitation does not come from an attacker reaching an exposed network service, it comes from a site having installed a poisoned update, so the real precondition is 'ran the compromised Supsystic Pro version', not 'is reachable over the network'. No EPSS score, no KEV listing, and no POC were provided in the input, so probabilistic exploitation signals are absent; however, for a supply-chain implant EPSS and POC are weak proxies because the malicious code is already resident on victims rather than something that must be exploited remotely. This should be treated as a high priority for any environment running Supsystic Pro, since compromise is presumed on affected versions rather than merely possible. The single tag 'Information Disclosure' understates impact - the description states full site control, not just data exposure - so defenders should not de-prioritize based on that tag.

A site administrator installs or auto-updates a Supsystic Pro plugin, unknowingly pulling the trojanized package from the compromised update server; the embedded code then reaches out and downloads a second-stage payload that steals stored credentials and gives the attacker persistent administrative control of the site. No user interaction beyond the routine update is required and no authentication barrier stops the implant, since it runs as trusted plugin code. No public POC is referenced in the available data.