CVE-2026-104023

Executive Summary

CVE-2026-104023 is a generic SQL injection vulnerability in the WordPress plugin "Smart Popup by Supsystic," affecting all versions up to and including 1.13.2. The flaw resides in insufficient escaping of the user-supplied sidx parameter and inadequate preparation of the existing SQL query, allowing an authenticated attacker with administrator-level access and above to inject additional SQL statements. Successful exploitation permits extraction of sensitive information from the underlying database, resulting in a high confidentiality impact.

Technical Analysis

The vulnerability is a classic instance of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). According to the NVD description, the plugin fails to properly escape the user-supplied sidx parameter and does not sufficiently prepare the existing SQL query before executing it. This combination — lack of input escaping plus lack of query parameterization — is the textbook precondition for SQL injection.

The specific attack surface is a plugin endpoint that accepts the sidx parameter. Because the parameter is concatenated or interpolated into an existing SQL query without sanitization, an attacker who can control its value can append additional SQL syntax. The result is that the application executes attacker-influenced SQL against the WordPress database.

Note that the CVSS vector indicates PR:H (High privileges required), meaning the attacker must already hold administrator-level access or above. This is an important nuance: this is not a pre-authentication injection. It is a post-authentication privilege-escalation and data-exfiltration issue. The lack of a public proof-of-concept and the absence of a Nuclei template mean that no confirmed weaponized exploit exists in the tracked sources, and the attack chain below must be read as inferred from the vulnerability class.

Technical detail on the precise query structure, the function or class that builds it, and the exact file path is not available from the NVD description. Any such specifics would be speculative and are therefore deliberately omitted.

Exploitation Scenarios

No public PoC is available; the attack chain described below is inferred from the SQL injection vulnerability class and the constraints stated in the NVD description.

1. Reconnaissance / target identification. An attacker enumerates WordPress installations to identify those running the Smart Popup by Supsystic plugin at version 1.13.2 or earlier. Because the plugin exposes a user-facing component, fingerprinting can be performed by inspecting plugin assets served by a target site.

2. Prerequisite access. The attacker must already possess administrator-level credentials or above on the target WordPress instance. This may be obtained through credential theft, phishing, a previously separate compromise, or abuse of an unrelated privilege-escalation flaw. Without this level of access, the sidx parameter is not reachable in a manner that enables injection.

3. Triggering the flaw class. With administrative access, the attacker supplies a crafted value for the sidx parameter to the affected plugin endpoint. Because the parameter is insufficiently escaped and the query is not properly prepared, the crafted value alters the structure of the SQL statement executed by the plugin, allowing additional SQL clauses to be appended to the original query.

4. Post-exploitation impact. Through the injected SQL, the attacker can cause the database to return data that the original query would not have exposed — for example, contents of other tables. The practical outcome is unauthorized read access to sensitive information stored in the WordPress database. The CVSS vector reflects this precisely: Confidentiality is High (C:H), while Integrity (I:N) and Availability (A:N) are unaffected, and the scope is unchanged (S:U).

Impact Assessment

Successful exploitation allows exfiltration of sensitive data from the WordPress database. The CVSS v3.1 base score is 4.9 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Subscore interpretation:

• AV:N (Network) — the vulnerable endpoint is reachable over the network, not restricted to a local context.
• AC:L (Low) — no special conditions beyond the stated prerequisites are required to trigger the issue.
• PR:H (High) — the attacker must hold administrator-level access or above. This substantially limits the population of viable attackers and is the primary reason the base score is moderate rather than critical.
• UI:N (None) — no user interaction is required once the attacker has the necessary access.
• S:U (Unchanged) — impact remains within the security scope of the vulnerable component.
• C:H / I:N / A:N — the impact is confined to confidentiality; the vulnerability does not permit modification or destruction of data through the described mechanism.

Blast radius: any WordPress site running Smart Popup by Supsystic at version 1.13.2 or earlier. In practice the exploit is meaningful mainly for insider threat models, credential-compromise scenarios, and cases where an attacker escalates from a lower-privileged foothold to an account with administrative rights. The confidentiality impact can be significant because WordPress databases commonly contain user credentials (hashed), email addresses, private content, and plugin-specific data.

EPSS has not yet been scored by FIRST.org for this CVE, so no exploitation-likelihood estimate is available. The CVE is not listed in CISA KEV, and no exploit code has been identified in the tracked sources.

Detection Guidance

Sigma Rule

title: Smart Popup by Supsystic SQL Injection via sidx Parameter
id: 7f9c1a2e-3b4d-4e5f-9a6b-1c2d3e4f5a6b
status: experimental
description: Detects SQL injection attempts targeting the sidx parameter in the Smart Popup by Supsystic WordPress plugin.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104023
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial-access
  - attack.t1190
  - cwe.89
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains: 'sidx='
  selection_sqli:
    cs-uri-query|contains:
      - 'union'
      - 'select'
      - 'concat'
      - 'information_schema'
      - '--'
      - '/*'
      - 'sleep('
      - 'benchmark('
  condition: selection_param and selection_sqli
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
falsepositives:
  - Legitimate administrative tooling using unexpected sidx values
level: medium

YARA Rule

rule CVE_2026_104023_Supsystic_SQLi
{
    meta:
        description = "Detects references to SQL injection patterns against Smart Popup by Supsystic sidx parameter"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104023"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "smart-popup" nocase
        $s2 = "supsystic" nocase
        $s3 = "sidx" nocase
        $sqli_a = "UNION SELECT" nocase
        $sqli_b = "information_schema" nocase
        $sqli_c = "concat(" nocase
        $sqli_d = "OR 1=1" nocase

    condition:
        (uint16(0) == 0x3C3F or $s1 or $s2) and
        $s3 and
        any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104023 Smart Popup by Supsystic SQL Injection Attempt (sidx)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"sidx="; nocase; pcre:"/(?:union[\s\+]+select|information_schema|concat\(|or[\s\+]+1=1|sleep\(|benchmark\()/i"; classtype:web-application-attack; reference:cve,2026-104023; sid:2026104023; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where network.protocol == "http" and url.query : "sidx=*" ]
  [ network where network.protocol == "http" and
      (url.query : "*union*select*" or
       url.query : "*information_schema*" or
       url.query : "*concat(*" or
       url.query : "*or 1=1*" or
       url.query : "*sleep(*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval q=urldecode(uri_query)
| where match(q, "(?i)sidx=")
| where match(q, "(?i)(union[\s\+]+select|information_schema|concat\(|or[\s\+]+1=1|sleep\(|benchmark\()")
| stats count min(_time) as first_seen max(_time) as last_seen values(q) as query by clientip
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,wordpress,sqli,">
  <rule id="100523" level="10">
    <if_sid>31100</if_sid>
    <url>sidx=</url>
    <regex type="pcre2">(?i)(union[\s\+]+select|information_schema|concat\(|or\s+1=1|sleep\(|benchmark\()</regex>
    <description>CVE-2026-104023: Smart Popup by Supsystic SQL injection attempt via sidx parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sqli,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict the number of accounts holding administrator-level access on affected WordPress installations, since exploitation requires that privilege level.
   • Enforce strong, unique credentials and multi-factor authentication for all administrative accounts to reduce the likelihood of an attacker obtaining the access this flaw requires.
   • Consider deactivating the Smart Popup by Supsystic plugin on any site that does not actively need it. Deactivation removes the attack surface entirely.
   • Apply virtual patching / WAF rules targeting the sidx parameter and common SQL injection payload patterns (see detection rules above) until a vendor fix is available.

2. Patch/upgrade steps.

   • No patched version has been identified. Monitor the vendor's official release channels for a fixed version and upgrade immediately once published.
   • Because no fixed version is currently known, do not assume that upgrading to any existing release resolves the issue. Verify any claimed fix against the vendor advisory.
   • If the plugin is abandoned or no fix is forthcoming, migrate to a maintained alternative.

3. Long-term hardening.

   • Implement database least-privilege: the WordPress database user should not hold permissions beyond what the application requires.
   • Enforce parameterized queries and prepared statements as a coding standard for all in-house plugin development; note that this vulnerability specifically stems from insufficient preparation of the SQL query.
   • Maintain an inventory of installed WordPress plugins and versions, and subscribe to vulnerability feeds to shorten the window between disclosure and remediation.
   • Deploy and tune the detection rules provided above to identify exploitation attempts even after patching.

References

• NVD — CVE-2026-104023: https://nvd.nist.gov/vuln/detail/CVE-2026-104023
• MITRE CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Security resources: https://wordpress.org/plugins/
• FIRST EPSS (score not yet available for this CVE): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence have been identified for this CVE in the provided data. CISA KEV status: not listed. No public proof-of-concept, Nuclei template, or exploit code was found in the tracked sources.