CVE-2026-104023 in Smart Popup by Supsystic Plugin
Summary
by MITRE • 10/10/2026
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in the Smart Popup by Supsystic plugin for WordPress represents a critical security flaw within version 1.13.2 and earlier iterations of the software. This issue is classified as an SQL Injection, specifically categorized under CWE-89 which denotes Improper Neutralization of Special Elements used in an SQL Command. The root cause lies in the insufficient sanitization and validation of user-supplied input, particularly within the sidx parameter utilized during database operations. When this plugin processes requests involving sorting or indexing data for popups, it fails to properly escape special characters or prepare statements against malicious payloads. This lack of rigorous input handling allows an attacker to manipulate the structure of SQL queries executed by the application backend.
From a technical perspective, the flaw enables authenticated attackers with administrator-level access and above to inject arbitrary SQL code into existing database queries. By appending additional commands through the sidx parameter, these actors can alter the intended logic of the query. This capability is particularly dangerous because it allows for data extraction beyond what was originally authorized by the application design. The attacker can potentially read sensitive information stored in the WordPress database, including user credentials, session tokens, and other proprietary content managed by the site administrators.
The operational impact of this vulnerability extends significantly due to the privilege level required to exploit it. While the requirement for administrator-level access might seem like a mitigating factor, it reflects a broader issue where high-privilege accounts are often targeted or compromised through social engineering, credential stuffing, or other lateral movement techniques within an organization. Once an attacker gains such elevated privileges and exploits this SQL injection vector, they can achieve full database compromise. This could lead to the exposure of personally identifiable information (PII), intellectual property theft, and potential defacement of the website if combined with further exploitation steps.
In terms of industry frameworks, this vulnerability aligns with ATT&CK technique T1059 which covers Command and Scripting Interpreter usage, as SQL commands are effectively scripts executed by the database engine to manipulate data. It also relates to T1005 Data from Local System where sensitive information is extracted directly from local storage mechanisms like databases. The failure to implement proper input validation highlights a deviation from secure coding practices recommended in OWASP guidelines for preventing injection flaws.
To mitigate this risk, immediate action should be taken by updating the Smart Popup plugin to version 1.13.3 or later where these issues have been addressed through improved parameter handling and query preparation mechanisms. For organizations unable to update immediately due to compatibility constraints, implementing a Web Application Firewall (WAF) rule set capable of detecting SQL injection patterns in POST parameters can provide an additional layer of defense. Furthermore, enforcing strict least-privilege principles for all administrative accounts and monitoring database logs for anomalous query structures can help detect potential exploitation attempts before significant damage occurs. Regular security audits and code reviews focusing on input validation are essential to prevent similar vulnerabilities from being introduced into WordPress ecosystems in the future.