CVE-2026-115223 in Smart Popup by Supsystic Plugin
Summary
by MITRE • 10/28/2026
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Smart Popup by Supsystic prior to version 2.0.2 represents a critical server-side template injection flaw within a widely used WordPress plugin. This security defect stems from an improper ordering of input sanitization operations, specifically involving the handling of user-supplied content stored within popup text blocks. The core technical issue lies in the sequence of data processing steps applied to this content before it is rendered by the internal template engine. A filter designed to strip dangerous template delimiters was implemented but executed prematurely in the pipeline. This initial sanitization step effectively removes or neutralizes specific characters that denote template syntax, creating a false sense of security regarding input validation at that stage.
However, subsequent processing steps include a decoding operation that reconstructs these very delimiters from encoded representations before the content is passed to the rendering engine. Because the stripping filter runs prior to this reconstruction phase, any payload containing encoded template markers bypasses the sanitization logic entirely. Once decoded, these reconstructed delimiters are interpreted by the server-side template engine as executable code rather than static text. This architectural flaw allows an attacker who has achieved authenticated administrator access on the WordPress site to inject arbitrary template expressions into popup configurations. The impact is severe because it grants the ability to execute commands within the context of the web application, effectively bypassing standard input validation controls that rely solely on character stripping without considering encoding transformations.
The operational impact of this vulnerability extends beyond simple code execution. An authenticated attacker can leverage server-side template injection techniques to read sensitive PHP constants and variables from the WordPress environment. This includes accessing database credentials stored in configuration files such as wp-config.php, which could lead to full database compromise if those credentials are reused or have elevated privileges. Additionally, attackers can extract authentication keys and salts used for session management and password hashing, potentially allowing them to forge administrative sessions or decrypt sensitive user data. The ability to read these internal constants demonstrates that the vulnerability provides deep introspection into the application's runtime environment, facilitating further exploitation steps such as privilege escalation or persistence mechanisms within the compromised WordPress installation.
From a classification perspective, this flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically server-side template injection where user input influences code execution without proper validation. It also relates to CWE-798 Use of Hard-coded Credentials if the extracted data includes static secrets, and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor due to the ability to read internal application constants. In terms of attack vectors, this vulnerability is associated with MITRE ATT&CK technique T1505 Server Software Component: Web Shell or similar server-side template injection patterns where attackers leverage legitimate software components for malicious purposes. The requirement for administrator authentication places it within the context of post-exploitation activities where an attacker has already gained initial access through other means, such as credential stuffing or exploiting a separate vulnerability in another plugin.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary solution is to upgrade the Smart Popup by Supsystic plugin to version 2.0.2 or later, where the developers have corrected the processing order to ensure that decoding occurs before sanitization, thereby preventing encoded payloads from bypassing filters. For sites unable to update immediately due to compatibility concerns, administrators should restrict access to the WordPress dashboard using strong multi-factor authentication and IP whitelisting to reduce the risk of unauthorized administrative login attempts. Additionally, implementing a Web Application Firewall with rules specifically tuned for template injection patterns can provide an additional layer of defense by blocking requests containing suspicious encoded delimiters or known exploit signatures. Regular security audits and penetration testing should be conducted to identify similar logic flaws in other plugins that may employ comparable input processing pipelines.