CVE-2026-115299
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings. This allows an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the plugin's contact-form notifications through infrastructure the attacker controls.
Risk Assessment
Attackers can intercept or redirect contact-form notifications, including personal data submitted by users, and abuse the hijacked SMTP configuration for further attacks.
Recommendation
Update the Contact Form by Supsystic plugin to version 1.11.1 or later. Verify SMTP settings and notification recipients and consider rotating mail server credentials.
Other vulnerabilities in Contact Form by Supsystic WordPress plugin
See all- CVE-2026-115302Medium
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records. This allows unauthenticated attackers to delete arbitrary statistics entries.
- CVE-2026-115301High
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
- CVE-2026-115300Medium
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics. This allows attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
- CVE-2025-15705Low
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
Original NVD description (English source)
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS