The Smart Popup by Supsystic WordPress plugin contains a flaw in its permission handling logic: within the havePermissions() function, an array merge operation overwrites the module’s administrator‑restricted action list, removing the ‘save’ action from protected methods. The plugin also accepts a generic nonce embedded in public subscription‑confirmation emails through an unauthenticated wp_ajax_nopriv_save endpoint, and the createWpSubscriber() function lacks a server‑side role allowlist. An attacker can therefore craft a POST request to admin‑ajax.php using a harvested nonce, set the role parameter to "administrator", and trigger a confirmation flow that creates a new WordPress Administrator account under the attacker’s control.

All releases of the Smart Popup by Supsystic WordPress plugin up to and including version 1.12.0 are affected. Any WordPress site that has installed or is running this plugin – regardless of its role or configuration – is impacted.

The CVSS score of 8.8 classifies this vulnerability as a high‑severity privilege escalation. EPSS data is not available, and it is not yet listed in the CISA KEV catalog, but the attack surface is public: the nonce is embedded in an email that can be harvested by anyone. Because the exploit requires no prior authentication and leverages a publicly exposed endpoint, the likelihood of exploitation is significant. Once an attacker creates an administrator account, full control of the site is achieved.