CVE-2026-73380

Executive Summary

CVE-2026-73380 is a critical-rated, unauthenticated PHP Object Injection vulnerability in Popup by Supsystic version 1.13.0 and earlier. The vulnerability allows a remote, unauthenticated attacker to inject malicious serialized PHP objects into the application; if a gadget chain is available in the application or its included libraries, this can lead to arbitrary code execution, full WordPress site compromise, data theft, and in many cases server-level compromise. The CVSS v3.1 base score is 9.8, and the vulnerability is currently unpatched with no known vendor fix or CISA KEV listing.

The affected component is the WordPress plugin Popup by Supsystic, which is deployed on internet-facing WordPress sites. Because no patch exists, all installations up to and including version 1.13.0 are considered vulnerable. EPSS scoring was not yet available from FIRST.org at the time of this report, but the combination of unauthenticated remote access and maximum impact metrics places this vulnerability at a critical severity for affected environments.

Technical Analysis

CWE-502 describes the unsafe deserialization of untrusted data. In PHP applications, object injection occurs when serialized PHP object data is supplied by the user and subsequently deserialized without sanitization or validation. The NVD description for CVE-2026-73380 indicates that Popup by Supsystic versions up to 1.13.0 allow an unauthenticated attacker to trigger this flaw. The description is sparse and does not identify a specific request parameter, endpoint, or function name, so this analysis is limited to the vulnerability class and the publicly documented affected version.

In a typical PHP object injection scenario, the application passes an untrusted string into an object deserialization routine. The attacker controls the structure of the Serialized PHP Object, including the class name and object properties. Even if the deserialized object is not immediately used, PHP object injection may become exploitable when magic methods are defined in the class or in related classes. A successful attack depends on the presence of a "POP chain" or gadget chain in the WordPress core, the plugin itself, or other installed plugins/themes. Such chains can lead to arbitrary file read/write, remote code execution, privilege escalation, or complete database compromise.

Because the vulnerability is unauthenticated, the attack surface includes any publicly reachable WordPress installation running the vulnerable plugin. An attacker does not need to authenticate or possess any site role to deliver the malicious serialized data. The lack of a published patch means threat actors attempting to weaponize this CVE can focus on developing reliable gadget chains without concern for attacker-triggered version differences in the plugin. No public proof-of-concept, Nuclei template, or exploit code was identified in the supplied data, so exploitation evidence is currently unknown.

Exploitation Scenarios

Attack chain for CVE-2026-73380, based strictly on the NVD description and vulnerability class:

1. Reconnaissance / Target Identification
   The attacker identifies WordPress sites running Popup by Supsystic version 1.13.0 or earlier. This can be done using web fingerprinting, HTTP response headers, WordPress plugin directory probes, or Shodan dorking for plugin assets such as wp-content/plugins/popup-by-supsystic. Publicly exposed login or admin pages are not required because the vulnerability is unauthenticated.

2. Triggering the Flaw
   The attacker sends a crafted HTTP request to a publicly accessible endpoint or input parameter that the plugin processes through unsafe deserialization. Because no endpoint name is documented in the NVD description, the exact trigger point cannot be stated. At the vulnerability-class level, the request must contain a Serialized PHP Object payload, typically formatted as a class name followed by zero or more properties, and sent in a request parameter or request body.

3. Payload / Execution Method
   The crafted serialized object is deserialized by the application. The attacker controls the object type and property values. If a gadget chain is available, the object's magic methods are invoked during or after deserialization, allowing the attacker to perform actions such as writing a webshell, reading files, calling arbitrary functions, or executing operating system commands in the context of the web server process.

4. Post-Exploitation Impact
   Successful exploitation grants the attacker a foothold on the WordPress application and often the underlying server. At a minimum, the attacker can potentially read sensitive data, modify site content, tamper with authentication, or embed malicious code. In a web server context, this frequently leads to full site defacement, customer data exfiltration, crypto-mining, abuse of server resources, and lateral movement into adjacent internal systems if the web server is not properly segmented.

No public PoC is available, so the above attack chain is inferred from the vulnerability class and the CVSS vector, not from a verified exploit. The technical detail in the NVD description is insufficient to enumerate specific payload locations or affected code paths.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a base score of 9.8, indicating critical severity. The exploitability metrics show that the attacker is remote on the network, needs no privileges and no user interaction, and faces low attack complexity. No special conditions such as authentication or social engineering are required. The impact metrics are all high: confidentiality, integrity, and availability are severely compromised if exploitation succeeds. Scope is unchanged, meaning the vulnerable component's security authority is the affected WordPress application and web server process.

Business impact for affected organizations includes:

• Complete compromise of the WordPress CMS and its data.
• Remote code execution, often as the web service account (www-data, nobody, apache, nginx, etc.).
• Theft of website databases, customer PII, credentials, and financial information.
• Malicious modification of site content, including malware distribution and SEO spam.
• Availability loss through website defacement, destructive file operations, or resource exhaustion.
• The potential for lateral movement if the web server has access to internal networks or secrets.

Because the plugin is commonly used in WordPress ecosystems, the blast radius includes marketing sites, small-to-medium business sites, and enterprise websites. The absence of a patch and the lack of vendor workarounds increases the likelihood that vulnerable sites will remain exploitable for an extended period.

EPSS scoring for this CVE is not yet available; however, the low attack complexity, unauthenticated access, and critical severity should prompt immediate threat-hunting activity even without a formal exploit-probability score.

Detection Guidance

Sigma Rule

title: Potential PHP Object Injection - Popup by Supsystic
id: 7b3a6f2c-8d4e-4f1a-9c2b-1a2b3c4d5e6f
status: experimental
description: Detects HTTP POST requests to Supsystic Popup paths containing serialized PHP object markers.
author: Valtersit Threat Intelligence
date: 2026-05-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73380
logsource:
    category: webserver
    product: generic
detection:
    selection_method:
        cs-method: POST
    selection_uri:
        cs-uri-query|contains:
            - 'supsystic'
            - 'popup-by-supsystic'
    selection_body:
        request_body|contains:
            - 'O:'
            - 'C:'
            - 's:'
    condition: selection_method and selection_uri and selection_body
falsepositives:
    - Legitimate plugin operations that transmit a small number of serialized PHP values
    - Admin actions that normally include cached objects or settings transfer
level: high

YARA Rule

rule CVE_2026_73380_PHP_Object_Injection {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects serialized PHP object payloads associated with Popup by Supsystic exploitation"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73380"
        date = "2026-05-01"
    strings:
        $s1 = "O:" ascii
        $s2 = "s:" ascii
        $s3 = "supsystic" ascii nocase
        $s4 = "popup-by-supsystic" ascii nocase
        $s5 = "a:" ascii
    condition:
        filesize < 10MB and
        any of ($s1, $s2, $s5) and
        any of ($s3, $s4)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-73380 - PHP Object Injection Attempt in Popup by Supsystic"; flow:established,to_server; content:"POST"; http_method; content:"supsystic"; http_uri; nocase; content:"O:"; http_request_body; content:"s:"; http_request_body; distance:0; classtype:attempted-admin; sid:20267380; rev:1;)

Elastic Detection

any where (event.module == "nginx" or event.module == "apache")
    and http.request.method == "POST"
    and url.path like "*supsystic*"
    and http.request.body like "*O:*"
    and http.request.body like "*s:*"

Splunk SPL Query

index=web sourcetype=access_combined_w3c method=POST uri=*supsystic*
| rex field=_raw "(?<php_obj>O:\d+:\")"
| where isnotnull(php_obj)
| stats count earliest(_time) latest(_time) by src_ip, uri, status
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,">
    <rule id="100733" level="12">
        <decoded>
            <program_name>^apache|nginx</program_name>
        </decoded>
        <match>supsystic</match>
        <regex>O:\d+:"</regex>
        <description>CVE-2026-73380: Attempted PHP Object Injection in Popup by Supsystic</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>attack.initial_access</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence was found from any tracked source, and no vendor fix or official workaround is currently available. Treat all Popup by Supsystic deployments up to and including version 1.13.0 as vulnerable.

1. Immediate Mitigations

• Disable or remove the Popup by Supsystic plugin on internet-facing WordPress sites until a patched version or vendor advisory is issued.
• If the plugin cannot be removed immediately, restrict access to the WordPress administrative and plugin endpoints via IP allowlists at the WAF or reverse-proxy level.
• Deploy a Web Application Firewall rule to inspect HTTP request bodies for serialized PHP object markers (O:, C:, a:) and block requests containing these patterns when sent to Supsystic plugin paths.
• Monitor web server and WordPress access logs for POST requests to Supsystic-related URI paths containing serialized-data indicators.
• Review existing WordPress installations for signs of compromise, including unexpected files, modified plugin files, unknown admin accounts, and outbound connections from the web server.

2. Patch / Upgrade Steps

• No vendor patch is available. Subscribe to Supsystic and WordPress plugin advisory channels to receive an update when the vendor publishes a fixed version.
• Do not downgrade to an earlier version; all versions up to and including 1.13.0 are affected.
• If a fixed release becomes available, upgrade the plugin immediately in a staging environment, verify site functionality, and deploy to production.
• Confirm that the patched version explicitly addresses unsafe deserialization of untrusted data before re-enabling the plugin.

3. Long-Term Hardening

• Apply WordPress core, theme, and plugin updates promptly, and remove unused plugins to reduce gadget-chain availability.
• Perform regular vulnerability scans and web asset inventories to detect WordPress plugins that are no longer maintained.
• Run the WordPress service with the least privilege necessary; restrict the web server account from writing to PHP files where possible.
• Harden PHP configuration to disable dangerous functions and limit memory/execution time where applicable.
• Enable network segmentation so a compromised web server cannot directly access internal databases, identity providers, or other sensitive systems.
• Maintain encrypted, versioned backups of WordPress content and databases, and test restoration procedures regularly.

Long-term, the underlying vulnerability class is best addressed by never deserializing untrusted data. The plugin vendor should perform a full review of all PHP object deserialization paths, validate input types, and reject serialized object data from unauthenticated users.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73380
• CWE-502: Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• MITRE ATT&CK Technique T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Directory – Popup by Supsystic: https://wordpress.org/plugins/popup-by-supsystic/
• OWASP – Deserialization of Untrusted Data: https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization

No known in-the-wild exploitation, threat actor campaigns, or published exploit code were identified in the data provided. CISA KEV has not listed CVE-2026-73380, and no vendor advisory was available at the time of writing.