CVE-2026-73381: Popup by Supsystic Auth Bypass Flaw

CVE-2026-73381 Overview

CVE-2026-73381 is a broken authentication vulnerability in the Popup by Supsystic WordPress plugin, affecting versions up to and including 1.13.0. The flaw allows unauthenticated network attackers to bypass authentication controls on affected WordPress installations. The weakness is categorized under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Successful exploitation compromises the integrity and availability of the WordPress site running the plugin. No user interaction, privileges, or prior access are required. Site operators using Popup by Supsystic should treat this issue as an urgent patching priority.

Critical Impact
Remote, unauthenticated attackers can bypass authentication in Popup by Supsystic <= 1.13.0, enabling high-impact actions against integrity and availability of the WordPress site.

Affected Products

Popup by Supsystic WordPress plugin versions <= 1.13.0
WordPress sites where the plugin is installed and activated
Any hosting environment exposing the affected plugin endpoints to the internet

Discovery Timeline

2026-08-18 - CVE-2026-73381 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73381

Vulnerability Analysis

The vulnerability is a broken authentication flaw (CWE-288) in the Popup by Supsystic WordPress plugin. An unauthenticated attacker can reach a protected code path without presenting valid credentials or nonces. This allows the attacker to invoke plugin functionality that should be restricted to authorized users.

According to the Patchstack advisory, all plugin releases through version 1.13.0 are affected. The attack vector is network-based and requires no user interaction. Confidentiality is not directly impacted, but integrity and availability of the WordPress site can be affected at a high level.

Root Cause

The root cause is an authentication check that can be bypassed through an alternate path or channel. The plugin exposes handlers that either omit capability checks, fail to validate WordPress nonces, or rely on a client-controlled value to determine authorization. As a result, requests originating from anonymous users are treated as if they were issued by an authorized principal.

Attack Vector

An attacker sends crafted HTTP requests to the WordPress site over the network. The request targets a plugin endpoint, typically exposed via admin-ajax.php or the WordPress REST API. Because the endpoint fails to enforce authentication, the attacker triggers privileged plugin actions and can modify plugin state or disrupt normal operation.

No verified proof-of-concept code is published. Technical specifics are limited to the Patchstack advisory. Refer to that reference for exploitation details as they become available.

Detection Methods for CVE-2026-73381

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php with plugin-specific action parameters referencing Supsystic popup handlers.
Unexpected modifications to Popup by Supsystic plugin settings, popup content, or database tables prefixed with the plugin namespace.
Anomalous outbound requests or newly injected scripts served through popups after suspicious admin-ajax traffic.

Detection Strategies

Inventory WordPress installations and identify sites running Popup by Supsystic version 1.13.0 or earlier.
Inspect web server access logs for unauthenticated requests to plugin endpoints followed by HTTP 200 responses.
Correlate WordPress audit logs with configuration changes to plugin settings that were not initiated by an authenticated administrator.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record plugin setting changes, user creation events, and option updates.
Alert on spikes in traffic to admin-ajax.php with Supsystic-related action values from unauthenticated sessions.
Monitor file integrity for the plugin directory and for WordPress theme or upload directories where injected content may appear.

How to Mitigate CVE-2026-73381

Immediate Actions Required

Update Popup by Supsystic to a version later than 1.13.0 once the vendor publishes a fixed release.
Restrict administrative access to WordPress by placing /wp-admin/ behind IP allow-lists or an authenticating reverse proxy where feasible.
Review WordPress user accounts, plugin settings, and popup content for unauthorized changes since exposure began.

Patch Information

Refer to the Patchstack advisory for Popup by Supsystic for the current fixed version and vendor guidance. Apply the patched release across all WordPress sites that use the plugin.

Workarounds

Deactivate and remove the Popup by Supsystic plugin until a patched version is installed.
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated requests to Supsystic plugin action handlers on admin-ajax.php.
Enforce authentication on the WordPress admin surface using HTTP basic auth, VPN, or single sign-on at the edge.

bash

# Example WAF rule concept: block unauthenticated admin-ajax requests
# targeting Supsystic popup actions until the plugin is patched.
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1002026733,\
   msg:'Block unauth Supsystic popup action (CVE-2026-73381)'"
  SecRule ARGS:action "@rx (?i)pps_|supsystic_popup" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"