CVE-2026-115223 Details
Description
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
A server-side template injection vulnerability has been identified in the Smart Popup by Supsystic WordPress plugin, affecting versions prior to 2.0.2. The vulnerability arises because the plugin does not properly sanitize template-injection payloads stored in popup text blocks. The filter intended to remove template delimiters is applied before a decoding step that restores them, allowing authenticated administrators to execute arbitrary template expressions on the server. This exploitation could lead to the disclosure of sensitive PHP constants, including database credentials and authentication keys.
Users are advised to update the Smart Popup by Supsystic WordPress plugin to version 2.0.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/cf475664-aa8f-49ec-b1d6-62139dbad8d4/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Supsystic Smart Popup | < 2.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |