Privilege Escalation in Smart Popup by Supsystic

The Smart Popup by Supsystic plugin for WordPress (versions up to and including 1.12.0) contains a critical privilege escalation vulnerability. The issue stems from a permission map collision in the havePermissions() function within classes/frame.php. Specifically, an array_merge() operation inadvertently overwrites restricted method lists, causing the save action to lose its administrator-only protection.

This flaw is further exacerbated by the plugin using a generic pps_nonce for subscription confirmation emails that is also accepted by the unauthenticated wp_ajax_nopriv_save endpoint. Because the createWpSubscriber() function lacks any server-side role allowlist, an attacker can submit a crafted POST request to admin-ajax.php. By manipulating the params[tpl][sub_wp_create_user_role] parameter, an attacker can elevate their privileges during the account creation process to become a WordPress Administrator. This vulnerability allows for full site takeover by unauthenticated parties.

Attack Chain

1. Attacker identifies a target WordPress site running a vulnerable version of the Smart Popup by Supsystic plugin.
2. Attacker triggers a subscription confirmation flow on the public-facing site to receive a confirmation email.
3. Attacker extracts the static pps_nonce from the publicly accessible subscription confirmation link in the email.
4. Attacker constructs a malicious POST request to wp-admin/admin-ajax.php targeting the wp_ajax_nopriv_save endpoint.
5. Attacker includes the harvested pps_nonce in the request to bypass initial validation.
6. Attacker injects params[tpl][sub_wp_create_user_role]=administrator into the POST body.
7. The vulnerable popupControllerPps::save() method executes and processes the creation of a new subscriber account.
8. The createWpSubscriber() function processes the request without role validation, resulting in the creation of a new Administrator account.

Impact

Successful exploitation results in full unauthorized administrative access to the affected WordPress installation. Attackers can gain control over the site, modify content, install malicious plugins, or exfiltrate sensitive data. All versions up to 1.12.0 are affected, posing a significant risk to any site utilizing this plugin for subscription management.

Recommendation

• Update the Smart Popup by Supsystic plugin to the latest available version immediately to remediate CVE-2026-18322.
• Monitor admin-ajax.php requests for suspicious action parameter values associated with popupControllerPps.
• Implement WAF rules to block or inspect POST requests to admin-ajax.php containing unauthorized modifications to user role parameters.
• Audit WordPress user accounts for suspicious additions, particularly those with administrative privileges created during unexpected timeframes.