This vulnerability in Popup by Supsystic arises from unsafe deserialization of untrusted data, enabling command injection attacks. It affects all versions up to 1.10.29. The CVSS score of 9.1 indicates a critical severity with network attack vector, low attack complexity, and no user interaction required, but requires high privileges. The vulnerability can result in full system compromise. No known exploits in the wild have been reported yet. No patch or official remediation details are currently available.

Successful exploitation can lead to command injection, allowing attackers to execute arbitrary commands on the affected system. This compromises confidentiality, integrity, and availability of the system. Given the high CVSS score and critical severity, the impact is severe, potentially enabling full system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is released, restrict access to the affected plugin and limit user privileges to reduce risk. Monitor official Supsystic communications for updates and apply any official fixes promptly once available.