{"id":"CVE-2026-115223","title":"Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block","summary":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimi…","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-1336"],"product":"Smart Popup by Supsystic","affected":["smart_popup_by_supsystic < 2.0.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-28T17:36:42.808153Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:47:59.351Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115223","references":[{"url":"https://wpscan.com/vulnerability/cf475664-aa8f-49ec-b1d6-62139dbad8d4/"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T11:09:40.348Z","slug":"CVE-2026-115223","body":"## Overview\n\nThe Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.\n\n## Affected\n\n- `smart_popup_by_supsystic < 2.0.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}