{
 "id": "WPSEC-2026-1521",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1521/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1521/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1521/index.md",
 "title": "Smart Popup by Supsystic <= 2.0.0 - Authenticated (Administrator+) Remote Code Execution via Server-Side Template Injection in Popup Content",
 "description": "The Popup Builder, Forms, CRM & Email Marketing Automation plugin for WordPress is vulnerable to Server-Side Template Injection via popup text values and [if]/[elseif] template conditions in all versions up to, and including, 2.0.0. This is due to popup content being rendered by an unsandboxed Twig environment, with condition expressions written directly into Twig tags and Twig delimiters in popup values left unescaped. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary Twig expressions and execute code on the server, which crosses a boundary in environments where administrators cannot otherwise run code, such as multisite or installations with file modifications disabled.",
 "plugin": {
  "slug": "popup-by-supsystic",
  "name": "Smart Popup by Supsystic",
  "full_name": "Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation",
  "wordpress_org": "https://wordpress.org/plugins/popup-by-supsystic/",
  "advisories_url": "https://wpsec.com/vuln/plugin/popup-by-supsystic/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/popup-by-supsystic"
 },
 "type": "RCE",
 "cwe": [
  "CWE-1336"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.0.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.0.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.0.2",
 "remediation": "Update to 2.0.2 or later.",
 "fix_released": "2026-10-22T12:54:07+00:00",
 "published": "2026-10-23T13:44:58+00:00",
 "updated": "2026-10-23T09:45:27.501261+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1521/",
  "https://plugins.svn.wordpress.org/popup-by-supsystic/tags/2.0.2/",
  "https://wordpress.org/plugins/popup-by-supsystic/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/popup-by-supsystic",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}