---
id: "CVE-2026-115302"
kind: "vulnerability"
aliases: ["CVE-2026-115302"]
title: "WordPress Contact Form plugin lets anyone delete form statistics records"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wordpress-plugins"]
not_affected_if: ["plugin-1.11.1-or-later", "plugin-not-installed"]
published_at: "2026-10-29T06:17:20+00:00"
first_seen_at: "2026-10-29T06:53:13+00:00"
updated_at: "2026-10-29T06:54:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115302", "first_seen_at": "2026-10-29T06:53:13+00:00"}]
---

# WordPress Contact Form plugin lets anyone delete form statistics records

The Contact Form by Supsystic WordPress plugin before 1.11.1 exposes an AJAX action that deletes stored form statistics without checking who is asking. An unauthenticated attacker can delete arbitrary statistics entries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin Plugins screen; versions before `1.11.1` are affected.

## Fix

- Move the Contact Form by Supsystic plugin to `1.11.1` or later.

## Timeline

- 2026-10-29T06:53:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115302

## From the sources

The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_