CVE-2026-18322 is a privilege escalation in Smart Popup by Supsystic 1.12.0 that works because three independent safeguards fail in sequence, none of them requiring authentication. You need to understand all three to defend against it.
The first failure is architectural: the plugin's permission system uses PHP's array_merge() to combine permission maps from a base controller and a child module. PHP treats numeric array keys as overwrite positions, not preserves — so when the base controller's permission array loads second, it silently clobbers the popup module's more restrictive 'administrator-only' rule on the 'save' action. This is not a bug in the sense of incorrect code; it's the natural result of merging permission maps without preserving key integrity. Check your codebase for any controller inheritance that merges permission arrays — if you see array_merge() on permission maps, that's your vulnerability.
The second failure is a nonce design error: the 'pps_nonce' appears in subscription confirmation emails sent to registered users, yet the same nonce value validates against an unauthenticated AJAX endpoint. The developer conflated CSRF protection (which nonce reuse satisfies technically) with access control (which it should never satisfy). If you have a WordPress site with Smart Popup active and any subscribers, those subscribers have the nonce in their inboxes right now. That nonce is your attack surface — no authentication required to reach the endpoint.
The third failure is absent input validation: the createWpSubscriber() function accepts a 'sub_wp_create_user_role' parameter directly from client input with no server-side allowlist. Once the permission gate is bypassed and you have a valid nonce, you specify 'administrator' as the role and the function creates an admin account.
The chain is: any visitor → finds a site with Smart Popup → requests subscription (or finds existing subscriber email) → extracts pps_nonce from confirmation email → sends AJAX request with that nonce plus sub_wp_create_user_role=administrator → gets persistent admin account.
What should worry you: this array_merge() permission collision pattern has appeared in multiple WordPress plugin families since 2019. The same base controller architecture that produced this vulnerability is the default pattern taught in WordPress development tutorials. If other Supsystic plugins share this controller inheritance structure, they likely have the same flaw. More broadly, treat any plugin permission system that uses array_merge() on permission maps as suspect until proven otherwise.