Template injection in Smart Popup by Supsystic lets admins read secrets
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1336.
Summary
The Smart Popup by Supsystic WordPress plugin before 2.0.2 fails to block template-injection payloads stored in a popup text block, because the delimiter filter runs before a decoding step that rebuilds them (CWE-1336). An authenticated administrator can execute arbitrary template expressions on the server and read PHP constants such as database credentials and authentication keys. The references include a link to an exploit.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Smart Popup by Supsystic | before 2.0.2 | 2.0.2 | Patch available | CNA |
- Smart Popup by Supsystic VendorUnknown Affected before 2.0.2 Fixed in 2.0.2 Patch available CNA
Remediation
Update Smart Popup by Supsystic to version 2.0.2 or later, which fixes the flaw. CISA does not list this vulnerability in its Known Exploited Vulnerabilities catalog.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Smart Popup by Supsystic (Unknown) Fixed in 2.0.2
Timeline
- 2026-10-28 Threatist record created from CVE-2026-115223
- 2026-10-28 Alias added: GHSA-mpjc-mm6h-74q4
- 2026-10-28 Weakness changed · CISA ADP
- 2026-10-28 CISA SSVC decision points changed
References
Sources
- CVE-2026-115223 · CVE Program
- CVE-2026-115223 · NVD
- FIRST EPSS
- GHSA-mpjc-mm6h-74q4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences