CVE-2026-115224: Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding

Q: Who can exploit this issue?

An authenticated WordPress administrator can exploit it. The available information does not indicate that lower-privileged users or unauthenticated visitors can trigger it.

Q: What access or input is required for exploitation?

The attacker needs administrator access and must be able to submit crafted page or category ID values while configuring a popup's page and category visibility bindings. Those values are incorporated into an INSERT statement without parameter binding or integer casting.

Q: What information could an attacker obtain?

The vulnerability allows arbitrary SQL injection and can be used to read contents of the WordPress database.

Q: Which versions are affected?

Versions of Smart Popup by Supsystic before 2.0.2 are affected. Upgrading to version 2.0.2 or later addresses the affected version range described here.

Published Oct 28, 2026

Updated

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.

Affected Software

1 affected component

Supsystic Smart Popup<2.0.2

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress administrator can exploit it. The available information does not indicate that lower-privileged users or unauthenticated visitors can trigger it.

What access or input is required for exploitation?

The attacker needs administrator access and must be able to submit crafted page or category ID values while configuring a popup's page and category visibility bindings. Those values are incorporated into an INSERT statement without parameter binding or integer casting.

What information could an attacker obtain?

The vulnerability allows arbitrary SQL injection and can be used to read contents of the WordPress database.

Which versions are affected?

Versions of Smart Popup by Supsystic before 2.0.2 are affected. Upgrading to version 2.0.2 or later addresses the affected version range described here.

CVE-2026-115224: Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or input is required for exploitation?

What information could an attacker obtain?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or input is required for exploitation?

What information could an attacker obtain?

Which versions are affected?