{"id":"CVE-2026-115302","kind":"vulnerability","aliases":["CVE-2026-115302"],"related":[],"title":"WordPress Contact Form plugin lets anyone delete form statistics records","description":"The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.","summary":"The Contact Form by Supsystic WordPress plugin before 1.11.1 exposes an AJAX action that deletes stored form statistics without checking who is asking. An unauthenticated attacker can delete arbitrary statistics entries.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugins"],"not_affected_if":["plugin-1.11.1-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin Plugins screen; versions before `1.11.1` are affected.","fix":"- Move the Contact Form by Supsystic plugin to `1.11.1` or later.","status":"open","published_at":"2026-10-29T06:17:20+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:38+00:00","updated_at":"2026-10-29T06:54:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T06:54:38Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Contact Form by Supsystic plugin to `1.11.1` or later.","reach":"internet","title":"WordPress Contact Form plugin lets anyone delete form statistics records","impact":"low","summary":"The Contact Form by Supsystic WordPress plugin before 1.11.1 exposes an AJAX action that deletes stored form statistics without checking who is asking. An unauthenticated attacker can delete arbitrary statistics entries.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attackers delete stored form statistics entries","analyst_note":"","how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin Plugins screen; versions before `1.11.1` are affected.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.11.1-or-later"],"who_is_affected":"Sites running the Contact Form by Supsystic WordPress plugin before 1.11.1 are exposed, since the flawed AJAX action is reachable without logging in. The impact is limited to deleting form statistics entries rather than code execution or full site takeover. Sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":4104,"output_tokens":522,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115302':13A,16A '-2026':12A,15A '1.11.1':30B,61C 'access':65C 'action':34B,69C 'ajax':33B,68C 'allow':76C 'anyon':6A 'arbitrari':50B,81C 'ask':44B 'attack':47B,78C 'check':41B 'contact':2A,23B,54C 'cve':11A,14A 'delet':7A,36B,49B,71C,80C 'entri':52B,83C 'expos':31B 'form':3A,8A,24B,38B,55C,73C 'let':5A 'packag':17B 'plugin':4A,21B,28B,59C 'record':10A,75C 'restrict':64C 'statist':9A,39B,51B,74C,82C 'store':37B,72C 'supsyst':26B,57C 'unauthent':46B,77C 'without':40B 'wordpress':1A,18B,20B,27B,58C 'wordpress-plugin':19B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Contact Form by Supsystic WordPress plugin before 1.11.1 are exposed, since the flawed AJAX action is reachable without logging in. The impact is limited to deleting form statistics entries rather than code execution or full site takeover. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115302","severity":null,"published_at":"2026-10-29T06:17:20+00:00","modified_at":"2026-10-29T06:17:20+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}