Live › vulnerability › CVE-2026-115302
The Contact Form by Supsystic WordPress plugin before 1.11.1 exposes an AJAX action that deletes stored form statistics without checking who is asking. An unauthenticated attacker can delete arbitrary statistics entries.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Contact Form by Supsystic WordPress plugin before 1.11.1 are exposed, since the flawed AJAX action is reachable without logging in. The impact is limited to deleting form statistics entries rather than code execution or full site takeover. Sites without this plugin can skip it.
No product ranges from the sources yet.
1.11.1 are affected.1.11.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
This page as .md · .json · in your agent: get_signal("CVE-2026-115302")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.