Unscored severity · published Oct 28, 2026
CVE-2026-115224
Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
New
–
CVSS
–
EPSS
No
On KEV
Description
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Customer Engagement System ·
before 2.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115224
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115224
exploit
https://wpscan.com/vulnerability/de33decd-1ef2-436d-9372-60a3afccf618/
More from Customer Engagement System
–
CVE-2026-115225
Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup