{"id":"CVE-2026-115591","kind":"vulnerability","aliases":["CVE-2026-115591"],"related":[],"title":"Supsystic Contact Form: plugin leaks embedded sensitive data in responses","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from n/a through 1.10.5.","summary":"The Contact Form by Supsystic WordPress plugin, through version 1.10.5, inserts sensitive information into data it sends to visitors. An attacker can retrieve that embedded sensitive data from the plugin's output.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of Contact Form by Supsystic (contact-form-by-supsystic) in the WordPress plugins screen or `wp plugin get contact-form-by-supsystic --field=version`\n- unknown whether the sources name the exact sensitive fields exposed","fix":"- Update Contact Form by Supsystic to a version later than `1.10.5` once a fixed release is confirmed\n- unknown whether a patched version number is given in the sources","status":"open","published_at":"2026-10-28T13:17:04+00:00","first_seen_at":"2026-10-28T13:33:00+00:00","triaged_at":"2026-10-28T13:34:08+00:00","updated_at":"2026-10-28T13:34:09+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T13:34:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update Contact Form by Supsystic to a version later than `1.10.5` once a fixed release is confirmed\n- unknown whether a patched version number is given in the sources","reach":"internet","title":"Supsystic Contact Form: plugin leaks embedded sensitive data in responses","impact":"medium","summary":"The Contact Form by Supsystic WordPress plugin, through version 1.10.5, inserts sensitive information into data it sends to visitors. An attacker can retrieve that embedded sensitive data from the plugin's output.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive embedded data is readable by remote visitors","analyst_note":"Confirm the fixed version and which data is exposed, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115591 and the plugin's WordPress.org changelog.","how_to_check":"- Check the installed version of Contact Form by Supsystic (contact-form-by-supsystic) in the WordPress plugins screen or `wp plugin get contact-form-by-supsystic --field=version`\n- unknown whether the sources name the exact sensitive fields exposed","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Contact Form by Supsystic at version `1.10.5` or earlier are affected. Sites that do not have the plugin installed can skip it. The sources do not say which data fields or configurations expose the sensitive content.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000633,"input_tokens":3321,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115591':13A,16A '-2026':12A,15A '1.10.5':34B,90C 'affect':82C 'allow':76C 'attack':45B 'contact':2A,26B,67C,72C,83C 'contact-form-by-supsyst':71C 'cve':11A,14A 'data':8A,39B,51B,63C 'data.this':80C 'embed':6A,49B,78C 'form':3A,27B,68C,73C,84C 'host':20B 'inform':37B,60C 'insert':35B,57C 'issu':81C 'leak':5A 'n/a':88C 'output':56B 'packag':17B 'plugin':4A,24B,31B,54B 'respons':10A 'retriev':47B,77C 'self':19B 'self-host':18B 'send':41B 'sensit':7A,36B,50B,59C,79C 'sent':62C 'supsyst':1A,29B,66C,70C,75C,86C 'version':33B 'visitor':43B 'vulner':64C 'wordpress':21B,23B,30B 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running Contact Form by Supsystic at version `1.10.5` or earlier are affected. Sites that do not have the plugin installed can skip it. The sources do not say which data fields or configurations expose the sensitive content.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115591","severity":null,"published_at":"2026-10-28T13:17:04+00:00","modified_at":"2026-10-28T13:17:04+00:00","first_seen_at":"2026-10-28T13:33:00+00:00","fetched_at":"2026-10-28T13:33:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}