CVE-2026-115303

Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.

Affected

Contact Form by Supsystic

CVSS v3.1 WPSCAN

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.22% chance of exploitation in the next 30 days, 13th percentile

Published

2026-10-29

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c32e3ccd-84cb-42a4-a343-353a02ccb541/find archive

CVE references

• https://wpscan.com/vulnerability/c32e3ccd-84cb-42a4-a343-353a02ccb541REFERENCE

References

• CVE Record
• NVD entry