All vulnerabilities
CVE-2026-115225

Customer Engagement System: Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup

Unknown Customer Engagement System
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.0.2Fixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.

Text from CVE List

Affected versions 1

  • Customer Engagement Systemaffected: all versions before 2.0.2CVE List

References 1