CVE-2026-18322: Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions() function in classes/frame.php, where arraymerge() overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing save from protected actions; this is compounded by the subscription confirmation email embedding the same generic ppsnonce that the unauthenticated wpajaxnoprivsave endpoint accepts, and by the complete absence of any server-side role allowlist in createWpSubscriber(). This makes it possible for unauthenticated attackers to submit a crafted POST request to admin-ajax.php using a nonce obtained from a public subscription confirmation email, setting params[tpl][subwpcreateuserrole] to administrator via the exposed popupControllerPps::save() action, and then triggering the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials.