CVE-2026-73380: Popup by Supsystic Auth Bypass Flaw

CVE-2026-73380 Overview

CVE-2026-73380 is an unauthenticated PHP Object Injection vulnerability in the Popup by Supsystic WordPress plugin, affecting versions 1.13.0 and earlier. The flaw allows remote attackers to inject arbitrary PHP objects into the application without authentication. Exploitation can lead to remote code execution, arbitrary file operations, or full site compromise when a suitable gadget chain is present in the WordPress installation. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Unauthenticated attackers can trigger PHP object deserialization over the network, enabling arbitrary code execution and complete site takeover on vulnerable WordPress installations.

Affected Products

Popup by Supsystic WordPress plugin, versions <= 1.13.0
WordPress sites using the vulnerable plugin with unauthenticated public endpoints
Any hosting environment running the affected plugin version

Discovery Timeline

2026-08-18 - CVE-2026-73380 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73380

Vulnerability Analysis

The Popup by Supsystic plugin deserializes attacker-controlled input using PHP's unserialize() function without validating its source or content. When PHP deserializes a crafted payload, it instantiates arbitrary objects and invokes magic methods such as __wakeup(), __destruct(), and __toString() on them. Attackers combine these magic method invocations with existing classes in WordPress core, themes, or other plugins to form gadget chains. A successful chain converts the object injection into concrete impact such as arbitrary file write, SQL execution, or command execution. The unauthenticated attack surface removes any credential barrier, making mass exploitation of exposed WordPress sites feasible.

Root Cause

The root cause is unsafe deserialization of untrusted input, categorized under CWE-502. The plugin passes user-supplied data directly into unserialize() without integrity checks, allow-listing of classes, or replacing the call with a safe format such as JSON. Any HTTP-reachable code path that feeds request data into deserialization becomes an injection point.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends an HTTP request containing a serialized PHP payload to a vulnerable endpoint exposed by the plugin. The plugin deserializes the payload, instantiating attacker-defined objects. When a gadget chain is available in the target's loaded PHP code, the chain executes and grants the attacker code execution or file system access in the WordPress process context. Refer to the Patchstack advisory for endpoint-specific details.

Detection Methods for CVE-2026-73380

Indicators of Compromise

HTTP request bodies or query parameters containing serialized PHP markers such as O: followed by a class name and length, or a: followed by array length
Unexpected PHP processes spawning shell commands, writing to wp-content/uploads/, or making outbound network connections from the web server
New or modified PHP files under the WordPress installation directory that were not deployed by administrators
WordPress error log entries referencing unserialize(), __wakeup, or __destruct from the Popup by Supsystic plugin path

Detection Strategies

Inspect web server access logs for POST or GET requests to Popup by Supsystic endpoints containing serialized object patterns like O:8:"stdClass" or base64-encoded equivalents
Deploy web application firewall rules that flag serialized PHP payloads reaching WordPress AJAX and REST endpoints
Monitor file integrity across the WordPress document root to catch webshell drops or plugin file tampering

Monitoring Recommendations

Enable verbose logging for PHP-FPM and correlate errors involving deserialization with source IP addresses in access logs
Alert on child processes of the web server user (www-data, apache, nginx) that execute sh, bash, curl, wget, or php from unexpected working directories
Track outbound HTTP connections from the WordPress host to unfamiliar destinations that may indicate command-and-control traffic

How to Mitigate CVE-2026-73380

Immediate Actions Required

Update the Popup by Supsystic plugin to a version later than 1.13.0 as soon as the vendor publishes a fix
If no patched version is available, deactivate and remove the plugin from all WordPress instances
Audit WordPress sites for signs of prior exploitation, including unauthorized administrator accounts and modified plugin or theme files
Rotate WordPress secrets in wp-config.php and reset administrator credentials on any host suspected of compromise

Patch Information

Consult the Patchstack advisory for the Popup by Supsystic plugin for the latest patched version and remediation guidance. Apply the update through the WordPress plugin manager or via WP-CLI once released.

Workarounds

Block the vulnerable plugin endpoints at the web application firewall or reverse proxy until a patched version is deployed
Add WAF signatures that reject request bodies containing PHP serialization tokens such as O: and a: followed by numeric length markers
Restrict access to the WordPress admin and AJAX endpoints by source IP where feasible
Enable PHP's disable_functions directive to remove dangerous functions like exec, system, and passthru from the runtime

bash

# Configuration example: disable the plugin via WP-CLI and add a temporary WAF rule
wp plugin deactivate popup-by-supsystic
wp plugin delete popup-by-supsystic

# Example ModSecurity rule to block serialized PHP payloads
SecRule ARGS|REQUEST_BODY "@rx O:\d+:\"[A-Za-z_\\\\]+\"" \
    "id:1073380,phase:2,deny,status:403,msg:'Possible PHP object injection'"