---
id: CVE-2026-115224
title: Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
summary: >-
  The Customer Engagement System  WordPress plugin before 2.0.2 does not safely
  build the SQL statements that store a popup's page and category visibility
  rules, concatenating request-supplied ID values directly into an INSERT
  statement wi…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-89
product: Customer Engagement System
affected:
  - customer_engagement_system < 2.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T17:41:13.376287Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:04.411Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115224'
references:
  - url: 'https://wpscan.com/vulnerability/de33decd-1ef2-436d-9372-60a3afccf618/'
tags:
  - cve.org
epss: 0.0024
epssPercentile: 0.15236
ingestedAt: '2026-10-28T07:06:27.131Z'
---

## Overview

The Customer Engagement System  WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.

## Affected

- `customer_engagement_system < 2.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.