The Smart Popup by Supsystic plugin for WordPress suffers from a privilege escalation vulnerability due to a permission map collision in the havePermissions() function in classes/frame.php. The use of array_merge() overwrites the popup module's administrator-restricted method list with the base controller's value, removing the 'save' action from protected actions. Additionally, the subscription confirmation email embeds a generic nonce (pps_nonce) accepted by an unauthenticated AJAX endpoint (wp_ajax_nopriv_save). The absence of a server-side role allowlist in createWpSubscriber() allows attackers to submit crafted POST requests to admin-ajax.php, setting the user role to administrator via the exposed popupControllerPps::save() action. This results in the creation of a persistent WordPress administrator account with attacker-chosen credentials.

Successful exploitation allows unauthenticated attackers to escalate privileges and create a persistent administrator account on the affected WordPress site. This grants full control over the site, including the ability to modify content, install plugins, and manage users, leading to complete compromise of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the admin-ajax.php endpoint and monitor for suspicious POST requests related to the popupControllerPps::save() action. Consider disabling or removing the Smart Popup by Supsystic plugin if immediate mitigation is required.