EUVD-2026-96087
GHSA-f758-pjm7-xv29
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress administrator credentials
-
ExploitSubmit crafted 'sidx' parameter to plugin endpoint
-
ExecutionAppend malicious SQL to unprepared query
-
ImpactExtract sensitive data from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session with WordPress administrator-level privileges (or higher) - consistent with CVSS PR:H. The attacker must reach the Smart Popup by Supsystic popup controller handling the 'sidx' parameter, which is passed into a SQL query (via classes/table.php / classes/db.php) without sufficient escaping or prepared-statement use. The decisive limiting factor is the administrator precondition: this is not remotely exploitable by anonymous or low-privileged users, which substantially reduces practical risk because a WordPress admin already has broad legitimate database and site access. Affected deployments are those running Smart Popup by Supsystic version 1.13.2 or earlier; upgrading to 1.13.3 remediates the issue. |
| Impact | This is a high-CVSS-component but low-real-world-priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N = 4.9 Medium) is internally consistent with the description: network-reachable, low complexity, but requiring PR:H (administrator-level access). The description explicitly confirms 'authenticated attackers, with administrator-level access and above,' which aligns with the PR:H metric - no conflict between vector and text here. No EPSS score, KEV listing, or POC was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The dominant risk-limiting factor is the administrator precondition: a WordPress administrator can already read the database through legitimate means and install arbitrary code, so the marginal privilege gained by this SQLi is minimal in most threat models. The realistic concern is narrow - multisite or delegated-admin environments where a lower-trust 'administrator' should not have raw database read, or chaining after a separate admin-account compromise. Absent KEV/EPSS/POC signals, this does not warrant emergency patching but should be remediated in normal cadence. |
| Exploit ScenarioDerived | An attacker who already holds (or has phished/hijacked) a WordPress administrator account submits a crafted 'sidx' parameter value to the Smart Popup by Supsystic request handler, appending a sub-query to the plugin's unprepared SQL statement. The injected query extracts sensitive data such as password hashes, secret keys, or user PII from the database. No public exploit code was identified in the provided data, and exploitation is gated by the required administrator privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
SQL injection in the 'sidx' parameter of the Smart Popup by Supsystic WordPress plugin (all versions up to and including 1.13.2) lets authenticated attackers with administrator-level privileges append arbitrary SQL statements to existing queries and extract sensitive data from the site's database. The CVSS vector confirms high privileges are required (PR:H) and impact is limited to confidentiality (C:H/I:N/A:N), and no public exploit or CISA KEV entry has been recorded - no public exploit identified at time of analysis - so despite a CVSS base score of 4.9 this is a low real-world-priority issue because an attacker must already hold the broad database and site access that administrators legitimately possess. Affected deployments are those running 1.13.2 or earlier; the vendor released 1.13.3 to remediate it.
RemediationAI
Upgrade the plugin to 1.13.3, which is the vendor-released patch (Trac changeset new=3736105@popup-by-supsystic/tags/1.13.3) and the version referenced by the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdf895c-dd2a-4e2c-b323-a42226982cb7?source=cve; no equivalent backport for 1.13.2 or earlier is indicated in the available data. If the update cannot be applied promptly, note that exploitation requires an authenticated administrator session, so the most effective compensating controls are privilege-focused: reduce and audit the number of accounts with administrator capability, enforce strong unique credentials and multifactor authentication on those accounts, and remove unused or shared admin logins - the trade-off is operational friction for site operators and possible disruption of delegated administration workflows. Where untrusted parties currently hold admin roles, temporarily deactivating the Smart Popup by Supsystic plugin removes the attack surface at the cost of losing popup functionality; a WAF or virtual-patch rule that rejects abnormal 'sidx' values on the plugin's admin handlers can also help but may break legitimate column-sorting requests and offers limited coverage against a user who can already modify site content. Lower-privileged users such as subscribers or visitors cannot trigger this issue under the assessed prerequisites.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP-based WordPress plugin, popup-by-supsystic, whose administrative list/table rendering pipeline passes the user-supplied 'sidx' (sort index/column) request parameter into SQL statement construction. Trac references show the request reaching modules/popup/controller.php (line 57) and classes/controller.php (lines 188 and 239), then flowing into the query builder in classes/table.php (line 269) and the database wrapper in classes/db.php (line 36), plus classes/model.php (line 168). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 'sidx' value is concatenated into the query - typically as an ORDER BY column specifier - without escaping or use of prepared statements, allowing an authenticated administrator to inject additional SQL. Because the primitives referenced build read-oriented SELECT queries, the assessed impact is data disclosure (C:H) with no integrity or availability component, and scope remains unchanged (S:U). The CPE cpe:2.3:a:supsysticcom:smart_popup_by_supsystic:*:*:*:*:*:*:*:* confirms the plugin's vendor product namespace and that all released versions are in scope up to the fix.
Know when Smart Popup By Supsystic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-reachable admin endpoint (AV:N/AC:L), but exploitation requires administrator privileges (PR:H); SQLi enables data extraction only, so C:H with I:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB