The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions() function in classes/frame.php, where array_merge() overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing save from protected actions; this is compounded by the subscription confirmation email embedding the same generic pps_nonce that the unauthenticated wp_ajax_nopriv_save endpoint accepts, and by the complete absence of any server-side role allowlist in createWpSubscriber(). This makes it possible for unauthenticated attackers to submit a crafted POST request to admin-ajax.php using a nonce obtained from a public subscription confirmation email, setting params[tpl][sub_wp_create_user_role] to administrator via the exposed popupControllerPps::save() action, and then triggering the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials.
References
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the
havePermissions()function inclasses/frame.php, wherearray_merge()overwrites the popup module's administrator-restricted method list with the base controller's value, silently removingsavefrom protected actions; this is compounded by the subscription confirmation email embedding the same genericpps_noncethat the unauthenticatedwp_ajax_nopriv_saveendpoint accepts, and by the complete absence of any server-side role allowlist increateWpSubscriber(). This makes it possible for unauthenticated attackers to submit a crafted POST request toadmin-ajax.phpusing a nonce obtained from a public subscription confirmation email, settingparams[tpl][sub_wp_create_user_role]toadministratorvia the exposedpopupControllerPps::save()action, and then triggering the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials.References