CVE-2026-115301

Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.

Affected

Contact Form by Supsystic

CVSS v3.1 CNA

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.42% chance of exploitation in the next 30 days, 36th percentile

Published

2026-10-29

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/15274345-5ad4-456f-9b5e-40d575ecb272/find archive

CVE references

• https://wpscan.com/vulnerability/15274345-5ad4-456f-9b5e-40d575ecb272REFERENCE

References

• CVE Record
• NVD entry