CVE-2026-17032
CriticalCVSS 9.8Summary
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.
Risk Assessment
Attackers can gain full control of WordPress sites, steal credentials and sensitive information, leading to severe security breaches and loss of trust.
Recommendation
Immediately update all Supsystic Pro plugins to the latest versions, scan sites for malicious code, and change all passwords and API keys.
Original NVD description (English source)
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.