---
id: "CVE-2026-115223"
kind: "vulnerability"
aliases: ["CVE-2026-115223"]
title: "WordPress Smart Popup plugin: stored template injection leaks site credentials"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-2.0.2-or-later", "plugin-not-installed"]
published_at: "2026-10-28T11:17:15+00:00"
first_seen_at: "2026-10-28T11:32:28+00:00"
updated_at: "2026-10-28T11:33:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115223", "first_seen_at": "2026-10-28T11:32:28+00:00"}]
---

# WordPress Smart Popup plugin: stored template injection leaks site credentials

The Smart Popup by Supsystic WordPress plugin before 2.0.2 fails to strip template delimiters from popup text, because a decoding step runs after the filter and rebuilds them. An authenticated administrator can inject template expressions that run on the server and read PHP constants such as database credentials and authentication keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Smart Popup by Supsystic plugin in the WordPress admin plugins list; anything below `2.0.2` is affected.
- Confirm the plugin is installed at all with `wp plugin list --name=*popup*` if WP-CLI is available.

## Fix

- Update the Smart Popup by Supsystic plugin to `2.0.2` or later.
- Rotate database credentials and authentication keys if an untrusted administrator account may have been used.

## Timeline

- 2026-10-28T11:32:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115223

## From the sources

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_