{"id":"CVE-2026-115300","kind":"vulnerability","aliases":["CVE-2026-115300"],"related":[],"title":"Contact Form by Supsystic WordPress plugin: forged requests delete stored leads","description":"The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.","summary":"The Contact Form by Supsystic WordPress plugin before 1.11.1 does not check a CSRF token or request origin on two administrator-only actions. An attacker who tricks a logged-in administrator into visiting a malicious page can permanently delete captured form submissions and wipe form statistics.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["contact-form","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-1.11.1-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugins list, or look for it under `wp-content/plugins/`.\n- Confirm whether the installed version is below `1.11.1`.","fix":"- Contact Form by Supsystic: `1.11.1`","status":"open","published_at":"2026-10-29T06:17:19+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:42+00:00","updated_at":"2026-10-29T06:54:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T06:54:42Z","model":"claude-haiku-5-5","output":{"fix":"- Contact Form by Supsystic: `1.11.1`","reach":"internet","title":"Contact Form by Supsystic WordPress plugin: forged requests delete stored leads","impact":"medium","summary":"The Contact Form by Supsystic WordPress plugin before 1.11.1 does not check a CSRF token or request origin on two administrator-only actions. An attacker who tricks a logged-in administrator into visiting a malicious page can permanently delete captured form submissions and wipe form statistics.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","contact-form"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"stored contact leads and analytics permanently deleted by forged admin request","analyst_note":"","how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugins list, or look for it under `wp-content/plugins/`.\n- Confirm whether the installed version is below `1.11.1`.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.11.1-or-later"],"who_is_affected":"Sites running the Contact Form by Supsystic plugin before 1.11.1 that have stored form submissions or statistics worth keeping. Exposure requires a logged-in administrator to visit an attacker-controlled page while signed in, so sites without that pattern face lower risk. Sites not using this plugin are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4145,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115300':14A,17A '-2026':13A,16A '1.11.1':34B,82C 'action':49B,97C 'administr':47B,58B,95C,130C 'administrator-on':46B,94C 'allow':111C 'analyt':123C 'attack':51B,112C 'bulk':100C 'bulk-delet':99C 'captur':67B,102C 'check':37B 'contact':1A,19B,27B,75C,120C 'contact-form':18B 'csrf':39B,87C 'cve':12A,15A 'delet':9A,66B,101C 'destroy':115C 'forg':7A,134C 'form':2A,20B,28B,68B,72B,76C,103C,108C 'lead':11A,121C 'log':56B,128C 'logged-in':55B,127C 'malici':62B 'origin':43B,91C 'packag':21B 'page':63B 'perman':65B,114C 'plugin':6A,25B,32B,80C 'request':8A,42B,90C,135C 'send':132C 'site':117C 'statist':73B,110C 'store':10A,119C 'submiss':69B,104C 'supsyst':4A,30B,78C 'token':40B,88C 'trick':53B,125C 'two':45B,93C 'valid':85C 'visit':60B 'wipe':71B,106C 'wordpress':5A,22B,24B,31B,79C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Contact Form by Supsystic plugin before 1.11.1 that have stored form submissions or statistics worth keeping. Exposure requires a logged-in administrator to visit an attacker-controlled page while signed in, so sites without that pattern face lower risk. Sites not using this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115300","severity":null,"published_at":"2026-10-29T06:17:19+00:00","modified_at":"2026-10-29T06:17:19+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}