{"id":"CVE-2026-115595","kind":"vulnerability","aliases":["CVE-2026-115595"],"related":[],"title":"Supsystic Contact Form: missing authorization check exposes access control flaw","description":"Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7.","summary":"Contact Form by Supsystic through version 1.10.7 has a missing authorization check, so access controls are not enforced on some actions. The sources do not say exactly which action an attacker can perform or what data they gain.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or `wp plugin get contact-form-by-supsystic --field=version`\n- unknown","fix":"- Update Contact Form by Supsystic to a version later than `1.10.7`\n- unknown","status":"open","published_at":"2026-10-26T11:16:34+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:31:14+00:00","updated_at":"2026-10-26T11:31:14+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T11:31:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update Contact Form by Supsystic to a version later than `1.10.7`\n- unknown","reach":"internet","title":"Supsystic Contact Form: missing authorization check exposes access control flaw","impact":"medium","summary":"Contact Form by Supsystic through version 1.10.7 has a missing authorization check, so access controls are not enforced on some actions. The sources do not say exactly which action an attacker can perform or what data they gain.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access control bypass on affected WordPress sites","analyst_note":"Check the NVD entry and the plugin changelog to find which action lacks the authorization check and what data or role it exposes.","how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or `wp plugin get contact-form-by-supsystic --field=version`\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Contact Form by Supsystic WordPress plugin at version 1.10.7 or earlier are affected. The sources do not say which configurations or roles are needed, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000578,"input_tokens":3318,"output_tokens":492,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115595':13A,16A '-2026':12A,15A '1.10.7':31B,94C 'access':8A,38B,81C 'action':45B,53B 'affect':86C 'allow':77C 'attack':55B 'author':5A,35B,64C 'check':6A,36B 'configur':80C 'contact':2A,25B,68C,73C,87C 'contact-form-by-supsyst':72C 'control':9A,39B,82C 'cve':11A,14A 'data':60B 'enforc':42B 'exact':51B 'exploit':78C 'expos':7A 'flaw':10A 'form':3A,26B,69C,74C,88C 'gain':62B 'host':20B 'incorrect':79C 'issu':85C 'levels.this':84C 'miss':4A,34B,63C 'n/a':92C 'packag':17B 'perform':57B 'plugin':24B 'say':50B 'secur':83C 'self':19B 'self-host':18B 'sourc':47B 'supsyst':1A,28B,67C,71C,76C,90C 'version':30B 'vulner':65C 'wordpress':21B,23B 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Contact Form by Supsystic WordPress plugin at version 1.10.7 or earlier are affected. The sources do not say which configurations or roles are needed, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115595","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115595","severity":null,"published_at":"2026-10-26T11:16:34+00:00","modified_at":"2026-10-26T11:16:34+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}