CVE-2026-115299

Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.

Affected

Contact Form by Supsystic

CVSS v3.1 CNA

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.09% chance of exploitation in the next 30 days, 0th percentile

Published

2026-10-29

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/102bbaf2-12c8-48b9-bacb-28de2baec45b/find archive

CVE references

• https://wpscan.com/vulnerability/102bbaf2-12c8-48b9-bacb-28de2baec45bREFERENCE

References

• CVE Record
• NVD entry