WordPress Plugin Privilege Escalation via Permission Map Collision

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing `save` from protected actions; this is compounded by the subscription confirmation email embedding the same generic `pps_nonce` that the unauthenticated `wp_ajax_nopriv_save` endpoint accepts, and by the complete absence of any server-side role allowlist in `createWpSubscriber()`. This makes it possible for unauthenticated attackers to submit a crafted POST request to `admin-ajax.php` using a nonce obtained from a public subscription confirmation email, setting `params[tpl][sub_wp_create_user_role]` to `administrator` via the exposed `popupControllerPps::save()` action, and then triggering the stored confirmation fl

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Smart Popup by Supsystic plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to 1.12.0. The flaw exists in the `havePermissions()` function within `classes/frame.php`, where `array_merge()` inadvertently overwrites the popup module's administrator-restricted method list with the base controller's values. This collision silently removes the `save` action from protected methods, allowing unauthenticated or lower-privileged users to execute administrative functions they shouldn't have access to. With a CVSS score of 8.8, this vulnerability directly impacts WordPress site owners running the affected plugin versions, potentially exposing millions of sites to unauthorized configuration changes, malicious popup injection, and lateral movement opportunities.

Casky's 224 mapped security skills leverage Claude's extended reasoning to identify the attack patterns inherent in CWE-269 (Improper Access Control) and MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would see detection patterns recognizing: (1) unexpected permission validation bypasses in plugin function calls, (2) method access logging showing `save` operations executed by non-admin accounts, (3) suspicious HTTP requests to plugin endpoints without proper capability checks, and (4) configuration changes originating from unauthenticated sessions. The platform's skill set would correlate these indicators with the specific permission collision mechanism, helping security teams identify both active exploitation attempts and misconfigured plugin instances that remain vulnerable to abuse.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18322.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-18322

Casky has 224 skills that investigate the attack patterns behind CVE-2026-18322. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn