CVE-2026-73380

CriticalCVSS 9.8

Published: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.

Risk Assessment

Potential for remote code execution on the server, which may result in full system compromise.

Recommendation

Update the Popup by Supsystic plugin to a version newer than 1.13.0.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.