CVE-2026-73381
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Unauthenticated Broken Authentication vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can bypass authentication mechanisms.
Risk Assessment
Potential unauthorized access to administrative functions or user data.
Recommendation
Update the Popup by Supsystic plugin to a version newer than 1.13.0.
Other vulnerabilities in Popup by Supsystic
See all- CVE-2026-102398High
The Popup by Supsystic plugin versions 1.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-73380Critical
Unauthenticated PHP Object Injection vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
- CVE-2026-27537Medium
Unauthenticated Cross Site Scripting (XSS) vulnerability in Popup by Supsystic up to version 1.11.2 allows an unauthenticated attacker to inject malicious scripts.
Original NVD description (English source)
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS