CVE-2026-17032 - Vulnerability Details - OpenCVE

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/7ca5ad30-1792-4014-bfad-88911cd64713/

History

Fri, 07 Aug 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200 CWE-287 CWE-94

Fri, 07 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-912
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 07 Aug 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-287 CWE-94

Thu, 06 Aug 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.
Title		Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server
References		https://wpscan.com/vulnerability/7ca5ad30-1792-4014-bfad-88911cd64713/
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-08-06T17:14:39.557Z

Updated: 2026-08-07T14:09:21.171Z

Reserved: 2026-07-24T11:57:21.250Z

Link: CVE-2026-17032

Vulnrichment

Updated: 2026-08-07T14:09:17.323Z

NVD

Status : Deferred

Published: 2026-08-06T22:16:49.237

Modified: 2026-08-26T16:31:16.753

Link: CVE-2026-17032

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17032", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-07-24T11:57:21.250Z", "datePublished": "2026-08-06T17:14:39.557Z", "dateUpdated": "2026-08-07T14:09:21.171Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-08-06T17:14:39.557Z"}, "title": "Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server", "problemTypes": [{"descriptions": [{"description": "CWE-912 Hidden Functionality", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "google-maps-easy-pro", "versions": [{"status": "affected", "versionType": "semver", "version": "1.6.9", "lessThan": "1.7.0"}], "defaultStatus": "unaffected"}, {"vendor": "Unknown", "product": "supsystic-gallery-pro", "versions": [{"status": "affected", "versionType": "semver", "version": "2.10.9", "lessThan": "2.11.1"}], "defaultStatus": "unaffected"}, {"vendor": "Unknown", "product": "tables-generator-pro", "versions": [{"status": "affected", "versionType": "semver", "version": "1.9.20", "lessThan": "1.10.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites."}], "references": [{"url": "https://wpscan.com/vulnerability/7ca5ad30-1792-4014-bfad-88911cd64713/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "value": "Mike Gozdiskowski", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-912", "lang": "en", "description": "CWE-912 Hidden Functionality"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T14:09:05.617754Z", "id": "CVE-2026-17032", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:09:21.171Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17032", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-07-24T11:57:21.250Z", "datePublished": "2026-08-06T17:14:39.557Z", "dateUpdated": "2026-08-07T14:09:21.171Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-08-06T17:14:39.557Z"}, "title": "Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server", "problemTypes": [{"descriptions": [{"description": "CWE-912 Hidden Functionality", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "google-maps-easy-pro", "versions": [{"status": "affected", "versionType": "semver", "version": "1.6.9", "lessThan": "1.7.0"}], "defaultStatus": "unaffected"}, {"vendor": "Unknown", "product": "supsystic-gallery-pro", "versions": [{"status": "affected", "versionType": "semver", "version": "2.10.9", "lessThan": "2.11.1"}], "defaultStatus": "unaffected"}, {"vendor": "Unknown", "product": "tables-generator-pro", "versions": [{"status": "affected", "versionType": "semver", "version": "1.9.20", "lessThan": "1.10.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites."}], "references": [{"url": "https://wpscan.com/vulnerability/7ca5ad30-1792-4014-bfad-88911cd64713/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "value": "Mike Gozdiskowski", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-17032", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T14:09:05.617754Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-912", "description": "CWE-912 Hidden Functionality"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:09:17.323Z"}}]}}