{"id":"CVE-2026-115303","kind":"vulnerability","aliases":["CVE-2026-115303"],"related":[],"title":"WordPress Contact Form plugin lets visitors inject extra email recipients","description":"The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.","summary":"The Contact Form by Supsystic WordPress plugin does not remove line breaks from form fields mapped into email headers. An unauthenticated visitor can add hidden Bcc or Cc recipients to the site's notification emails.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["contact-form","package","php","wordpress"],"not_affected_if":["no-header-field-mapping","plugin-not-installed"],"how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugin list.\n- Look for forms that map a submitted field into the Reply-To, From or Cc header.","fix":"- Update the Contact Form by Supsystic plugin to `1.11.1` or later.","status":"open","published_at":"2026-10-29T09:17:08+00:00","first_seen_at":"2026-10-29T09:23:58+00:00","triaged_at":"2026-10-29T09:24:36+00:00","updated_at":"2026-10-29T09:24:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T09:24:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Contact Form by Supsystic plugin to `1.11.1` or later.","reach":"internet","title":"WordPress Contact Form plugin lets visitors inject extra email recipients","impact":"low","summary":"The Contact Form by Supsystic WordPress plugin does not remove line breaks from form fields mapped into email headers. An unauthenticated visitor can add hidden Bcc or Cc recipients to the site's notification emails.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","contact-form","php"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Form notifications are sent to attacker-chosen hidden recipients","analyst_note":"","how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugin list.\n- Look for forms that map a submitted field into the Reply-To, From or Cc header.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-header-field-mapping"],"who_is_affected":"Sites running the Contact Form by Supsystic plugin before 1.11.1 that map a form field into the Reply-To, From or Cc email header are exposed. Sites without such a mapping, or without the plugin, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000666,"input_tokens":4163,"output_tokens":499,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115303':13A,16A '-2026':12A,15A '1.11.1':66C 'add':46B 'addit':115C 'allow':105C 'arbitrari':110C 'bcc':48B,116C 'break':34B 'cc':50B,103C,118C 'charact':71C 'concaten':80C 'configur':90C 'contact':2A,18B,24B,59C 'contact-form':17B 'cr/lf':70C 'cve':11A,14A 'email':9A,40B,57B,84C,111C,123C 'extra':8A 'field':37B,77C,95C 'form':3A,19B,25B,36B,60C,88C 'header':41B,85C,104C,112C 'hidden':47B 'inject':7A,109C 'let':5A 'line':33B 'map':38B,92C 'notif':56B,122C 'outgo':83C 'packag':20B 'php':21B 'plugin':4A,29B,64C 're':74C 're-valid':73C 'recipi':10A,51B,119C 'remov':32B 'repli':99C 'reply-to':98C 'site':54B 'strip':69C 'submit':76C,94C 'supsyst':27B,62C 'unauthent':43B,106C 'user':107C 'valid':75C 'valu':78C 'visitor':6A,44B 'wordpress':1A,22B,28B,63C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Contact Form by Supsystic plugin before 1.11.1 that map a form field into the Reply-To, From or Cc email header are exposed. Sites without such a mapping, or without the plugin, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115303","severity":null,"published_at":"2026-10-29T09:17:08+00:00","modified_at":"2026-10-29T09:17:08+00:00","first_seen_at":"2026-10-29T09:23:58+00:00","fetched_at":"2026-10-29T09:23:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}