CVE-2026-115301
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
Risk Assessment
Full server compromise may occur, including arbitrary code execution and leakage of critical secrets (salts, database credentials), potentially leading to takeover of the entire site and data.
Recommendation
Update the Contact Form by Supsystic plugin to version 1.11.1 or later. Review stored forms for suspicious content and consider rotating secrets and database credentials.
Other vulnerabilities in Contact Form by Supsystic WordPress plugin
See all- CVE-2026-115302Medium
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records. This allows unauthenticated attackers to delete arbitrary statistics entries.
- CVE-2026-115300Medium
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics. This allows attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
- CVE-2026-115299Medium
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings. This allows an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the plugin's contact-form notifications through infrastructure the attacker controls.
- CVE-2025-15705Low
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
Original NVD description (English source)
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS