---
id: "CVE-2026-115303"
kind: "vulnerability"
aliases: ["CVE-2026-115303"]
title: "WordPress Contact Form plugin lets visitors inject extra email recipients"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["contact-form", "package", "php", "wordpress"]
not_affected_if: ["no-header-field-mapping", "plugin-not-installed"]
published_at: "2026-10-29T09:17:08+00:00"
first_seen_at: "2026-10-29T09:23:58+00:00"
updated_at: "2026-10-29T09:24:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115303", "first_seen_at": "2026-10-29T09:23:58+00:00"}]
---

# WordPress Contact Form plugin lets visitors inject extra email recipients

The Contact Form by Supsystic WordPress plugin does not remove line breaks from form fields mapped into email headers. An unauthenticated visitor can add hidden Bcc or Cc recipients to the site's notification emails.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugin list.
- Look for forms that map a submitted field into the Reply-To, From or Cc header.

## Fix

- Update the Contact Form by Supsystic plugin to `1.11.1` or later.

## Timeline

- 2026-10-29T09:23:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115303

## From the sources

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_