CVE-2026-73380
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Unauthenticated PHP Object Injection vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
Risk Assessment
Potential for remote code execution on the server, which may result in full system compromise.
Recommendation
Update the Popup by Supsystic plugin to a version newer than 1.13.0.
Other vulnerabilities in Popup by Supsystic
See all- CVE-2026-102398High
The Popup by Supsystic plugin versions 1.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-73381Critical
Unauthenticated Broken Authentication vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can bypass authentication mechanisms.
- CVE-2026-27537Medium
Unauthenticated Cross Site Scripting (XSS) vulnerability in Popup by Supsystic up to version 1.11.2 allows an unauthenticated attacker to inject malicious scripts.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS