Live › vulnerability › CVE-2026-115300
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not check a CSRF token or request origin on two administrator-only actions. An attacker who tricks a logged-in administrator into visiting a malicious page can permanently delete captured form submissions and wipe form statistics.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Contact Form by Supsystic plugin before 1.11.1 that have stored form submissions or statistics worth keeping. Exposure requires a logged-in administrator to visit an attacker-controlled page while signed in, so sites without that pattern face lower risk. Sites not using this plugin are not affected.
No product ranges from the sources yet.
wp-content/plugins/.1.11.1.1.11.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
This page as .md · .json · in your agent: get_signal("CVE-2026-115300")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.