{"id":"CVE-2026-115223","aliases":["EUVD-2026-111973","GHSA-mpjc-mm6h-74q4"],"status":"published","title":"Smart Popup by Supsystic \u003c 2.0.2 - Admin+ SSTI via Popup Text Block","description":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00418,"percentile":0.36635,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1336"],"published":"2026-10-28T10:45:14Z","modified":"2026-10-28T18:31:58Z","products":[{"vendor":"supsysticcom","product":"smart popup by supsystic"},{"vendor":"unknown","product":"smart popup by supsystic"}],"references":[{"url":"https://wpscan.com/vulnerability/cf475664-aa8f-49ec-b1d6-62139dbad8d4/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115223"},{"url":"https://wpscan.com/vulnerability/cf475664-aa8f-49ec-b1d6-62139dbad8d4"},{"url":"https://github.com/advisories/GHSA-mpjc-mm6h-74q4"}],"sources":{"cve":[{"id":"CVE-2026-115223","title":"Smart Popup by Supsystic \u003c 2.0.2 - Admin+ SSTI via Popup Text Block","description":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.","status":"published","published":"2026-10-28T10:45:14.251Z","modified":"2026-10-28T17:47:59.351Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:20:01.618694Z"}],"euvd":[{"id":"EUVD-2026-111973","description":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.","status":"published","published":"2026-10-28T10:45:14Z","modified":"2026-10-28T17:47:59Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:19.529238Z"}],"ghsa":[{"id":"GHSA-mpjc-mm6h-74q4","title":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection...","description":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.","status":"published","published":"2026-10-28T12:30:36Z","modified":"2026-10-28T18:31:58Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:14:35.861264Z"}],"nvd":[{"id":"CVE-2026-115223","description":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.","status":"published","published":"2026-10-28T11:17:15.8Z","modified":"2026-10-28T18:17:11.52Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:13:04.340553Z"}]}}