SQL Injection Vulnerability in Smart Popup by Supsystic for WordPress
CVE-2026-104023

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Smart Popup By Supsystic
Vendor
CVE Published:
10 October 2026

What is CVE-2026-104023?

The Smart Popup by Supsystic plugin for WordPress is susceptible to SQL injection attacks through the 'sidx' parameter due to inadequate escaping of user-supplied input. This vulnerability allows authenticated users with administrator-level access to manipulate existing SQL queries, potentially exposing sensitive database information. Ensuring proper input validation and query preparation is critical to mitigate such risks.

Affected Version(s)

Smart Popup by Supsystic 0 <= 1.13.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/popup-by-supsy...
https://plugins.trac.wordpress.org/browser/popup-by-supsy...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.