What is the CVSS score of EUVD-2026-54200?

EUVD-2026-54200 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Supsystic Pro are affected by EUVD-2026-54200?

The Supsystic Pro WordPress plugin family delivered malware through the vendor's compromised update server, installing credential-stealing backdoors on every site that applied the poisoned updates.. A patch is available.

How to fix or mitigate EUVD-2026-54200?

Within 24 hours: identify all WordPress instances running Supsystic Pro; immediately disable and remove the plugin; scan systems for web shells and malicious processes; change all WordPress and database credentials. Within 7 days: examine server and database audit logs for evidence of credential harvesting or unauthorized data access; implement WAF and IDS rules to detect command-and-control signatures; enable enhanced logging and alerting. Within 30 days: conduct forensic analysis to determine scope of data exfiltration; perform credential compromise assessment across all services that access affected systems; maintain plugin removal status and monitor vendor security advisories for verified patched release.

Supsystic Pro EUVD-2026-54200

| CVE-2026-17032 CRITICAL

Hidden Functionality (CWE-912)

2026-08-06 contact@wpscan.com

GHSA-8x7c-xgmw-fg3x

Information Disclosure

9.8

CVSS 3.1 · Vendor: wpscan

Severity by source

Vendor (wpscan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Trojanized code runs as trusted plugin with no auth or interaction and yields full site control, so PR:N/UI:N and C/I/A all High; scope kept Unchanged as impact stays within the WordPress instance.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wpscan).

CVSS VectorVendor: wpscan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 06, 2026 - 23:03 EUVD

Analysis Generated

Aug 06, 2026 - 22:36 vuln.today

CVE Published

Aug 06, 2026 - 22:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

AnalysisAI

Supply-chain compromise of the Supsystic Pro WordPress plugin family delivered trojanized plugin updates from the vendor's own compromised update server, giving unauthenticated attackers a foothold on every site that pulled the poisoned release. The embedded malicious code fetches a second-stage payload that harvests credentials and other sensitive data and hands the operator full control of the affected WordPress site. Reported by WPScan; no public exploit is identified and the issue is not listed in CISA KEV at time of analysis, though the delivery mechanism means the implant is effectively pre-planted rather than requiring an active attack against each target.

Technical ContextAI

The affected component is the Supsystic Pro line of commercial WordPress plugins (the vendor ships several, e.g. popup, data-tables, and membership products). The root cause is not a traditional defect in the plugin's own logic but a distribution-channel compromise: the vendor's update server served plugin packages containing embedded malicious code, so WordPress's normal update flow installed attacker code as trusted plugin files. No CWE was supplied in the input, but the behavior maps to the embedded-malicious-code / supply-chain classes (conceptually CWE-506 Embedded Malicious Code, plus reliance on an untrusted upstream distribution channel). Because the code executes inside the WordPress PHP runtime, it inherits full application privileges and database access, which is why it can stage a second payload and exfiltrate credentials.

RemediationAI

No vendor-released patched version is identified at time of analysis, and because this is a distribution-channel compromise rather than a code bug, simply 'updating' is not automatically safe until the vendor confirms a clean release served from a secured server - treat any Supsystic Pro update pulled during the compromise window as suspect. Immediately identify and remove or disable the affected Supsystic Pro plugins, then, because credentials were exfiltrated and full site control was possible, rotate all WordPress admin and database passwords, API keys, and secret salts, and audit for unknown admin users, unexpected scheduled tasks, and injected PHP files rather than trusting the site is clean after removal. Where the functionality is business-critical, isolate the site as a stopgap - block outbound connections to unknown hosts to cut the second-stage download and exfiltration channel, and restrict wp-admin access by IP - while awaiting a vendor-confirmed clean build; note the trade-off that outbound blocking may also break legitimate plugin update and license checks. Consult the WPScan advisory (https://wpscan.com/vulnerability/7ca5ad30-1792-4014-bfad-88911cd64713/) and the vendor's own incident notice for the confirmed clean version once published.