CVE-2026-17032

Published: Aug 6, 2026Modified: Aug 26, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: contact@wpscan.com (Secondary)

Description

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

Related CWEs

CWE-912

Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

References (1)

https://wpscan.com/vulnerability/7ca5ad30-1792-4014-bfad-88911cd64713/

Source: contact@wpscan.com

Timeline

No history available yet.