CVE-2026-115223: Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated WordPress administrator. The available information does not indicate that lower-privileged users or unauthenticated visitors can trigger it.
What access does successful exploitation provide?
An administrator can cause arbitrary template expressions to be evaluated server-side. This can expose PHP constants, including database credentials and authentication keys.
Which installations are affected?
Smart Popup by Supsystic versions earlier than 2.0.2 are affected. The issue is triggered through a popup text block whose stored content is later processed by the plugin's template engine.