{"id":"CVE-2026-115223","kind":"vulnerability","aliases":["CVE-2026-115223"],"related":[],"title":"WordPress Smart Popup plugin: stored template injection leaks site credentials","description":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.","summary":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 fails to strip template delimiters from popup text, because a decoding step runs after the filter and rebuilds them. An authenticated administrator can inject template expressions that run on the server and read PHP constants such as database credentials and authentication keys.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-2.0.2-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Smart Popup by Supsystic plugin in the WordPress admin plugins list; anything below `2.0.2` is affected.\n- Confirm the plugin is installed at all with `wp plugin list --name=*popup*` if WP-CLI is available.","fix":"- Update the Smart Popup by Supsystic plugin to `2.0.2` or later.\n- Rotate database credentials and authentication keys if an untrusted administrator account may have been used.","status":"open","published_at":"2026-10-28T11:17:15+00:00","first_seen_at":"2026-10-28T11:32:28+00:00","triaged_at":"2026-10-28T11:33:40+00:00","updated_at":"2026-10-28T11:33:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T11:33:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Smart Popup by Supsystic plugin to `2.0.2` or later.\n- Rotate database credentials and authentication keys if an untrusted administrator account may have been used.","reach":"internet","title":"WordPress Smart Popup plugin: stored template injection leaks site credentials","impact":"high","summary":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 fails to strip template delimiters from popup text, because a decoding step runs after the filter and rebuilds them. An authenticated administrator can inject template expressions that run on the server and read PHP constants such as database credentials and authentication keys.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs server-side template expressions and reads database credentials and auth keys","analyst_note":"","how_to_check":"- Check the installed version of the Smart Popup by Supsystic plugin in the WordPress admin plugins list; anything below `2.0.2` is affected.\n- Confirm the plugin is installed at all with `wp plugin list --name=*popup*` if WP-CLI is available.","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-2.0.2-or-later"],"who_is_affected":"Sites running the Smart Popup by Supsystic WordPress plugin older than `2.0.2`. Exploitation requires an administrator account, so the risk sits with sites where admin access is shared or can be obtained by others. Sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000634,"input_tokens":3364,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115223':13A,16A '-2026':12A,15A '2.0.2':33B,84C 'administr':55B,126C 'allow':123C 'arbitrari':129C 'authent':54B,74B,125C,147C 'block':99C 'constant':68B,138C 'credenti':10A,72B,145C 'cve':11A,14A 'databas':71B,144C 'decod':44B,118C 'delimit':38B,114C 'engin':106C 'evalu':102C 'execut':128C 'express':59B,131C 'fail':34B 'filter':49B,109C 'host':20B 'inject':7A,57B,90C 'key':75B,148C 'later':101C 'leak':8A 'meant':110C 'packag':17B 'payload':91C 'php':67B,137C 'plugin':4A,24B,31B,82C 'popup':3A,27B,40B,78C,97C 'prevent':87C 'read':66B,136C 'rebuild':51B 'reconstruct':121C 'run':46B,61B,115C 'self':19B 'self-host':18B 'server':64B,133C 'server-sid':132C 'side':134C 'site':9A,142C 'smart':2A,26B,77C 'step':45B,119C 'store':5A,94C 'strip':36B,112C 'supsyst':29B,80C 'templat':6A,37B,58B,89C,105C,113C,130C 'template-inject':88C 'text':41B,98C 'wordpress':1A,21B,23B,30B,81C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Smart Popup by Supsystic WordPress plugin older than `2.0.2`. Exploitation requires an administrator account, so the risk sits with sites where admin access is shared or can be obtained by others. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115223","severity":null,"published_at":"2026-10-28T11:17:15+00:00","modified_at":"2026-10-28T11:17:15+00:00","first_seen_at":"2026-10-28T11:32:28+00:00","fetched_at":"2026-10-28T11:32:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}