# CVE-2026-18322: Supsystic Smart Popup privilege escalation via permission collision

Source: https://junglewise.ai/threats/cve-2026-18322-supsystic-smart-popup-privilege-escalation-via-permission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18322 · Severity: high · CVSS 8.8 · Published 2026-08-05

The Smart Popup by Supsystic plugin for WordPress contains a vulnerability that allows unauthenticated attackers to create administrator accounts. An attacker can intercept a public subscription confirmation email, extract a token from it, and use that token to bypass security checks and create a new WordPress Administrator account with attacker-controlled credentials. This grants complete administrative control over the affected WordPress site, enabling theft of all site data, malware injection, or site takeover.

Technologies: [Supsystic Smart Popup](https://junglewise.ai/threats/technologies/smart-popup). Vendors: [Supsystic](https://junglewise.ai/threats/vendors/supsystic).

## Quick answers

**Is CVE-2026-18322 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18322 being exploited in the wild.

**How severe is CVE-2026-18322?** High severity, with a CVSS score of 8.8, published 5 August 2026.

**Which products and versions are affected?** Supsystic Smart Popup up to and including 1.12.0.

**Is there a fix for CVE-2026-18322?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18322 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-18322?** Check whether you run Supsystic Smart Popup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation due to a permission map collision in the `havePermissions()` function in `classes/frame.php`. The `array_merge()` operation incorrectly overwrites the popup module's administrator-restricted method list with the base controller's value, removing `save` from the list of protected actions. Combined with a generic `pps_nonce` embedded in public subscription confirmation emails and a complete absence of server-side role validation in the `createWpSubscriber()` function, unauthenticated attackers can submit a crafted POST request to `admin-ajax.php` with the nonce from a confirmation email. By setting `params[tpl][sub_wp_create_user_role]` to `administrator`, the exposed `popupControllerPps::save()` action allows creation of a persistent WordPress Administrator account with arbitrary credentials.

## Affected products

- Supsystic Smart Popup up to and including 1.12.0

## Timeline

- 2026-08-05: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.11.2/classes/frame.php](https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.11.2/classes/frame.php)
- [https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.11.2/modules/popup/models/popup.php](https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.11.2/modules/popup/models/popup.php)

## Related threats

- [Smart Popup by Supsystic server-side template injection in popup text block](https://junglewise.ai/threats/cve-2026-115223-the-smart-popup-by-supsystic-wordpress-plugin-before-2-0-2-does)
- [Smart Popup by Supsystic SSRF in MailChimp lookup](https://junglewise.ai/threats/cve-2026-115225-the-customer-engagement-system-wordpress-plugin-before-2-0-2)
- [Supsystic Smart Popup SQL injection in sidx parameter](https://junglewise.ai/threats/cve-2026-104023-the-smart-popup-by-supsystic-plugin-for-wordpress-is-vulnerable)