Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-104023 · Microsoft / collected KEV context

cve-program · CVE-2026-104023

• https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdf895c-dd2a-4e2c-b323-a42226982cb7?source=cve
• https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/modules/popup/controller.php#L57
• https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/table.php#L269
• https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/db.php#L36
• https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/controller.php#L188
• https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/controller.php#L239
• https://plugins.trac.wordpress.org/browser/popup-by-supsystic/tags/1.13.2/classes/model.php#L168
• https://plugins.trac.wordpress.org/browser/popup-by-supsystic/
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3736105%40popup-by-supsystic%2Ftags%2F1.13.3&old=3719020%40popup-by-supsystic%2Ftags%2F1.13.2

No related operational record is retained in the current change model.