Description

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T15:17:06.143Z",
  "pubdate": "2026-08-18T15:17:06.143Z",
  "executiveSummary": "An unauthenticated broken authentication vulnerability has been identified in the Popup by Supsystic plugin for WordPress, specifically affecting versions 1.13.0 and below.\nThis security flaw exposes affected systems to severe risks, allowing unauthenticated threat actors to bypass standard access controls and potentially interact with privileged functionality or sensitive administrative interfaces provided by the plugin.\nThe vulnerability stems from improper handling of authentication checks and session validation within the codebase.\nSuccessful exploitation requires network access to the target WordPress installation, but demands no prior privileges or valid user credentials, enabling anonymous attackers to compromise the integrity and security of the application.\nThe risk implication is critical, as unauthorized access to plugin mechanisms can lead to further exploitation vectors, unauthorized data manipulation, or administrative takeover depending on the exposed endpoints and backend logic.\nOrganizations utilizing the affected versions must apply immediate updates or implement strict perimeter controls to mitigate potential abuse.",
  "technicalDetails": "The vulnerability resides in the authentication and authorization enforcement mechanisms implemented within the Popup by Supsystic plugin for WordPress, impacting all versions up to and including 1.13.0.\nThe root cause of the issue is the absence of robust cryptographic token validation, improper session management, or missing capability checks on sensitive AJAX actions and controller endpoints.\nSpecifically, the vulnerable component fails to verify whether an incoming request originates from an authenticated user with administrative privileges before executing privileged backend operations.\nFrom a network exposure perspective, the vulnerable endpoints are accessible over HTTP/HTTPS to any remote, unauthenticated attacker who can craft valid Hypertext Transfer Protocol requests targeting the WordPress REST API, admin-ajax.php, or direct plugin routing mechanisms.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the exposed plugin endpoints responsible for handling specific administrative or restricted actions. Second, the attacker crafts a malicious HTTP request targeting these endpoints, omitting any valid session cookies, nonces, or authentication headers.\nThird, due to the flawed authentication logic in the plugin, the backend code fails to reject the request and instead processes the input parameters as if they originated from a trusted, authenticated administrator.\nFinally, the server executes the requested functionality, returning sensitive data or executing unauthorized state changes.\nThe payload behavior depends on the specific endpoint targeted, but generally involves bypassing security gates to interact with internal database structures, configuration settings, or administrative utilities managed by Popup by Supsystic.\nPost-exploitation impact includes unauthorized modification of plugin configurations, potential injection of malicious payloads into web pages rendered by the popup mechanism, and broader compromise of the underlying WordPress installation if chained with other vulnerabilities."
}