Live › vulnerability › CVE-2026-115303
The Contact Form by Supsystic WordPress plugin does not remove line breaks from form fields mapped into email headers. An unauthenticated visitor can add hidden Bcc or Cc recipients to the site's notification emails.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 09:23 UTC. All times on this page are UTC.
Sites running the Contact Form by Supsystic plugin before 1.11.1 that map a form field into the Reply-To, From or Cc email header are exposed. Sites without such a mapping, or without the plugin, can skip it.
No product ranges from the sources yet.
1.11.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
This page as .md · .json · in your agent: get_signal("CVE-2026-115303")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.