Description

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T15:17:06.003Z",
  "pubdate": "2026-08-18T15:17:06.003Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the Popup by Supsystic plugin, affecting all versions up to and including 1.13.0. This security flaw arises from the insecure handling of user-supplied input passed to vulnerable unserialize operations within the application codebase. Unauthenticated remote threat actors can exploit this vulnerability by crafting malicious serialized payloads transmitted via network requests to the target system. Successful exploitation of this vulnerability leads to severe security implications, potentially enabling arbitrary code execution, file deletion, or other malicious behaviors depending on the availability of compatible gadget chains within the application context or loaded third-party libraries. The absence of authentication and privilege requirements significantly lowers the barrier to entry for potential attackers, allowing complete compromise of vulnerable WordPress instances utilizing the affected plugin versions. Remediation requires updating the Popup by Supsystic plugin to a patched version once available or restricting access to vulnerable entry points.",
  "technicalDetails": "The vulnerability is classified as a PHP Object Injection flaw stemming from the insecure deserialization of untrusted data. The root cause lies in the application processing user input through the native PHP unserialize() function without proper validation, sanitization, or type checking. The affected component resides within the codebase of Popup by Supsystic <= 1.13.0, where input parameters received via HTTP requests are passed directly into the deserialization routine.\nExploitation of this vulnerability requires network access to the target WordPress site hosting the vulnerable plugin. The attack does not require authentication or specific privileges, allowing any remote unauthenticated attacker to interact with the vulnerable endpoint. The attack flow begins when the threat actor crafts a serialized PHP object payload containing a malicious structure designed to leverage existing application or plugin classes that implement magic methods such as __wakeup() or __destruct().\nUpon transmission of the malicious payload via HTTP GET or POST parameters, the vulnerable component executes the unserialize() function on the supplied input string. PHP automatically instantiates the object specified in the payload and triggers the associated magic methods during the object lifecycle. If the application environment contains suitable gadget chains—classes with methods that perform dangerous operations when invoked—the attacker can achieve secondary impacts such as remote code execution, SQL injection, Server-Side Request Forgery (SSRF), or arbitrary file manipulation depending on the loaded classes.\nPost-exploitation impact ranges from complete system compromise to unauthorized data access, as the execution context inherits the permissions of the web server user. Because the vulnerability is exposed over the network without authentication requirements, automated exploit scripts can target instances of Popup by Supsystic <= 1.13.0 at scale, making timely mitigation critical for securing affected environments."
}