The Smart Popup by Supsystic plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 1.12.0. The issue stems from a permission map collision in the havePermissions() function where array_merge() overwrites the popup module's administrator-restricted method list with the base controller's value, removing 'save' from protected actions. Additionally, the subscription confirmation email embeds a generic nonce (pps_nonce) accepted by an unauthenticated AJAX endpoint (wp_ajax_nopriv_save), and there is no server-side role allowlist in createWpSubscriber(). These factors allow unauthenticated attackers to send crafted POST requests to admin-ajax.php using the nonce from a public email, set the user role to administrator via the exposed save action, and create persistent WordPress administrator accounts with attacker-chosen credentials.

Successful exploitation allows unauthenticated attackers to escalate privileges and create persistent WordPress administrator accounts. This results in full control over the affected WordPress site, including the ability to modify content, install malicious code, and compromise site integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to admin-ajax.php where possible and monitor for suspicious POST requests targeting the save action. Avoid using affected versions of the plugin and consider disabling it if immediate patching is not possible.