Executive brief
The Smart Popup by Supsystic plugin for WordPress contains a vulnerability that allows unauthenticated attackers to create administrator accounts. An attacker can intercept a public subscription confirmation email, extract a token from it, and use that token to bypass security checks and create a new WordPress Administrator account with attacker-controlled credentials. This grants complete administrative control over the affected WordPress site, enabling theft of all site data, malware injection, or site takeover.
Technical details
The vulnerability is a privilege escalation due to a permission map collision in the `havePermissions()` function in `classes/frame.php`. The `array_merge()` operation incorrectly overwrites the popup module's administrator-restricted method list with the base controller's value, removing `save` from the list of protected actions. Combined with a generic `pps_nonce` embedded in public subscription confirmation emails and a complete absence of server-side role validation in the `createWpSubscriber()` function, unauthenticated attackers can submit a crafted POST request to `admin-ajax.php` with the nonce from a confirmation email. By setting `params[tpl][sub_wp_create_user_role]` to `administrator`, the exposed `popupControllerPps::save()` action allows creation of a persistent WordPress Administrator account with arbitrary credentials.
Affected products
- Supsystic Smart Popup up to and including 1.12.0
Timeline
- 2026-08-05: disclosed