SQL injection in Smart Popup by Supsystic via sidx parameter
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
The Smart Popup by Supsystic plugin for WordPress, in all versions up to and including 1.13.2, is vulnerable to SQL Injection via the 'sidx' parameter. Insufficient escaping of user-supplied input and a lack of prepared statements in an existing SQL query let an authenticated attacker with administrator-level access or above append additional SQL queries to existing ones. This can be used to extract sensitive information from the database.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Smart Popup by Supsystic.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-10 Threatist record created from CVE-2026-104023
- 2026-10-10 Alias added: GHSA-f758-pjm7-xv29
- 2026-10-11 CISA SSVC decision points changed
References
Other 9
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdf895c-dd2a-4e2c-b323-a42226982cb7?source=cve
- https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/modules/popup/controller.php#L57
- https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/table.php#L269
- https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/db.php#L36
- https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/controller.php#L188
- https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/controller.php#L239
- https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/model.php#L168
- https://plugins.trac.wordpress.org/browser/popup-by-supsystic/
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3736105%40popup-by-supsystic%2Ftags%2F1.13.3&old=3719020%40popup-by-supsystic%2Ftags%2F1.13.2
More Supsystic vulnerabilities
- TI-2023-02984 Supsystic Popup < 1.10.19 - Prototype Pollution CVSS 3.1CRITICAL 9.8
- TI-2023-28011 WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-03704 Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality CVSS 3.1CRITICAL 9.8
- TI-2020-19380 WordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSS CVSS 4.0HIGH 8.7
- TI-2020-19379 WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx CVSS 4.0HIGH 8.8
- TI-2020-19378 WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS CVSS 4.0HIGH 8.8
Sources
- CVE-2026-104023 · CVE Program
- CVE-2026-104023 · NVD
- FIRST EPSS
- GHSA-f758-pjm7-xv29 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences