CVE-2026-115225: Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup
The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Smart Popup by Supsysticto a version that resolves this vulnerability.Fixed in 2.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can reach the affected MailChimp interest-group lookup functionality. No valid MailChimp API key is required.
What can an attacker do with the vulnerable endpoint?
An attacker can cause the WordPress server to open connections to arbitrary internal hosts and ports. Response timing can reveal which internal services are reachable.
Which installations are affected?
Smart Popup by Supsystic versions earlier than 2.0.2 are affected. The issue is exposed through the plugin's MailChimp interest-group lookup functionality.