{"id":"CVE-2026-115301","kind":"vulnerability","aliases":["CVE-2026-115301"],"related":[],"title":"WordPress Contact Form plugin: stored template injection runs server code","description":"The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.","summary":"The Contact Form by Supsystic WordPress plugin before 1.11.1 renders stored form-editor content through a template engine without sandboxing it. An administrator can inject template code that runs on the server, and the payload executes for any visitor who loads a page with the form, exposing secrets such as salts and database credentials.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["contact-form-by-supsystic","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-1.11.1-or-later"],"how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugins list; versions below `1.11.1` are in the stated range.\n- Review stored form templates for unexpected template syntax if the plugin has been in use on this site.","fix":"- Contact Form by Supsystic: `1.11.1` or later (the sources state the fix is in 1.11.1).","status":"open","published_at":"2026-10-29T06:17:20+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:42+00:00","updated_at":"2026-10-29T06:54:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T06:54:42Z","model":"claude-haiku-5-5","output":{"fix":"- Contact Form by Supsystic: `1.11.1` or later (the sources state the fix is in 1.11.1).","reach":"internet","title":"WordPress Contact Form plugin: stored template injection runs server code","impact":"high","summary":"The Contact Form by Supsystic WordPress plugin before 1.11.1 renders stored form-editor content through a template engine without sandboxing it. An administrator can inject template code that runs on the server, and the payload executes for any visitor who loads a page with the form, exposing secrets such as salts and database credentials.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","contact-form-by-supsystic","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs on the server; secrets and database credentials readable by visitors","analyst_note":"","how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugins list; versions below `1.11.1` are in the stated range.\n- Review stored form templates for unexpected template syntax if the plugin has been in use on this site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.11.1-or-later"],"who_is_affected":"Sites running the Contact Form by Supsystic WordPress plugin before version 1.11.1 are exposed, since any visitor to a page containing a form triggers the stored payload. Sites without this plugin, or already on 1.11.1 or later, are not affected. Exploitation first requires an administrator account to store the payload.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000721,"input_tokens":4183,"output_tokens":605,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115301':13A,16A '-2026':12A,15A '1.11.1':38B,93C 'administr':53B,122C 'allow':106C 'also':157C 'arbitrari':132C 'authent':169C 'code':10A,57B,119C,133C 'compil':141C 'contact':2A,18B,31B,86C 'contact-form-by-supsyst':17B 'contain':150C 'content':44B,111C 'credenti':84B,173C 'cve':11A,14A 'databas':83B,172C 'editor':43B,110C 'enabl':120C 'engin':48B,99C,115C 'execut':66B,117C,131C,143C 'expos':77B 'form':3A,19B,32B,42B,76B,87C,104C,109C,152C 'form-editor':41B,108C 'host':25B 'inject':7A,55B,129C,138C 'let':158C 'load':71B,147C 'packag':22B 'page':73B,149C 'payload':65B,156C 'perform':124C 'plugin':4A,29B,36B,91C 'reach':113C 'read':162C 'render':39B,102C 'run':8A,59B 'salt':81B,170C 'sandbox':50B,96C 'secret':78B,166C 'self':24B 'self-host':23B 'server':9A,62B,126C,136C,164C 'server-sid':125C,163C 'side':127C,165C 'store':5A,40B,107C,155C 'supsyst':21B,34B,89C 'templat':6A,47B,56B,98C,118C,128C,139C 'unauthent':160C 'use':100C 'visitor':69B,146C,161C 'whenev':144C 'without':49B 'wordpress':1A,26B,28B,35B,90C 'wordpress-plugin':27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Contact Form by Supsystic WordPress plugin before version 1.11.1 are exposed, since any visitor to a page containing a form triggers the stored payload. Sites without this plugin, or already on 1.11.1 or later, are not affected. Exploitation first requires an administrator account to store the payload.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115301","severity":null,"published_at":"2026-10-29T06:17:20+00:00","modified_at":"2026-10-29T06:17:20+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}