CVE-2026-18322 Overview
CVE-2026-18322 is a privilege escalation vulnerability in the Smart Popup by Supsystic plugin for WordPress, affecting all versions up to and including 1.12.0. The flaw lets unauthenticated attackers create persistent WordPress Administrator accounts by abusing a permission map collision in the havePermissions() function inside classes/frame.php. Attackers combine a nonce harvested from a public subscription confirmation email with the exposed popupControllerPps::save() action to reach createWpSubscriber() and set sub_wp_create_user_role to administrator. The issue is tracked under [CWE-269: Improper Privilege Management].
Critical Impact
Unauthenticated attackers can create WordPress Administrator accounts with attacker-chosen credentials, resulting in full site takeover.
Affected Products
- Smart Popup by Supsystic plugin for WordPress
- All versions up to and including 1.12.0
- WordPress sites with the vulnerable plugin activated and subscription confirmation enabled
Discovery Timeline
- 2026-08-05 - CVE-2026-18322 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-18322
Vulnerability Analysis
The vulnerability stems from a permission map collision inside the plugin's central authorization routine. In classes/frame.php, the havePermissions() function uses PHP's array_merge() to combine permission maps. The base controller's entries overwrite the popup module's administrator-restricted method list, silently removing save from the protected actions list.
With save no longer gated, the popupControllerPps::save() action becomes reachable through admin-ajax.php. The plugin compounds the flaw by embedding the generic pps_nonce value in subscription confirmation emails. That same nonce is accepted by the unauthenticated wp_ajax_nopriv_save endpoint, giving any subscriber a valid token for privileged operations.
Downstream, the createWpSubscriber() routine in the subscribe module lacks any server-side role allowlist. It accepts the attacker-supplied params[tpl][sub_wp_create_user_role] value verbatim and passes it to WordPress user creation, allowing arbitrary role assignment.
Root Cause
Three defects chain together to produce the impact. First, array_merge() in havePermissions() overwrites nested permission arrays rather than deep-merging them, dropping the save restriction. Second, the plugin reuses one static pps_nonce value in outbound emails intended for unauthenticated recipients. Third, createWpSubscriber() performs no capability check and no role validation before invoking user creation.
Attack Vector
An attacker first subscribes to a popup on the target site and receives the confirmation email containing the pps_nonce value. The attacker then submits a crafted POST request to admin-ajax.php targeting the popupControllerPps::save() action, supplying the harvested nonce and setting params[tpl][sub_wp_create_user_role] to administrator. Triggering the stored confirmation flow then creates a persistent WordPress Administrator account with attacker-chosen username, email, and password. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for source-level detail.
Detection Methods for CVE-2026-18322
Indicators of Compromise
- New WordPress user accounts with the administrator role created shortly after a subscription confirmation event
- POST requests to /wp-admin/admin-ajax.php with action=save and parameter params[tpl][sub_wp_create_user_role]=administrator
- Unauthenticated requests hitting the wp_ajax_nopriv_save handler for the popupControllerPps module
- Unexpected entries in wp_users and wp_usermeta with role administrator and non-corporate email domains
Detection Strategies
- Inspect web server access logs for admin-ajax.php requests containing sub_wp_create_user_role in the request body
- Audit the WordPress user table for administrator accounts created via the subscription flow, correlating with user_registered timestamps
- Alert on any privileged role assignment originating from an unauthenticated session context
Monitoring Recommendations
- Enable WordPress audit logging for user creation and role change events
- Forward admin-ajax.php request payloads to a centralized logging or SIEM platform for detection engineering
- Baseline normal subscription confirmation volume and alert on spikes tied to POST parameters referencing user roles
How to Mitigate CVE-2026-18322
Immediate Actions Required
- Update the Smart Popup by Supsystic plugin to a version later than 1.12.0 that includes the fix from the referenced changeset
- Audit wp_users for unauthorized administrator accounts and remove any that cannot be attributed to legitimate operators
- Rotate credentials and session tokens for all administrator accounts on affected sites
- Review outbound subscription confirmation emails and invalidate any static pps_nonce values still in circulation
Patch Information
The vendor addressed the flaw in the subscribe module. See the WordPress Plugin Changeset and the Wordfence Vulnerability Report for fix details. Administrators should upgrade to the patched release immediately.
Workarounds
- Deactivate and remove the Smart Popup by Supsystic plugin until the patched version is deployed
- Block requests to admin-ajax.php where action=save originates from unauthenticated clients targeting the popup controller
- Restrict user registration via WordPress core settings and enforce approval workflows for new accounts
# Example WAF rule blocking the exploitation pattern
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1026183220,msg:'CVE-2026-18322 Supsystic Popup priv-esc attempt'"
SecRule REQUEST_BODY "@rx sub_wp_create_user_role=administrator" "t:urlDecodeUni,t:lowercase"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
