CVE-2026-104023

MediumCVSS 4.9

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 10/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

The Smart Popup by Supsystic plugin for WordPress up to version 1.13.2 is vulnerable to SQL Injection via the 'sidx' parameter due to insufficient escaping and lack of query preparation.

Risk Assessment

Authenticated attackers with administrator-level access can append additional SQL queries to extract sensitive information from the database, potentially compromising data confidentiality.

Recommendation

Update the Smart Popup plugin to the latest version. Restrict administrator access to trusted users only.

Other vulnerabilities in Smart Popup by Supsystic

CVE-2026-18322High
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions() function and lack of server-side role allowlist, allowing unauthenticated attackers to create a WordPress Administrator account.

Original NVD description (English source)

The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS