Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/de33decd-1ef2-436d-9372-60a3afccf618 İstismar kodu ya da analiz

Kayıt geçmişi

1. 28 Eki 2026 21:10CVSS puanı değişti: – → 4.1
2. 28 Eki 2026 09:00Yayımlandı

İlgili açıklar

• 5,8 CVE-2026-115225Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup
• 8,5 CVE-2026-115603WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability
• 8,5 CVE-2026-111850WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
• 9,3 CVE-2026-111411WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability
• 9,3 CVE-2026-115607WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability
• 9,6 CVE-2026-103792Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versio…