CVE-2026-115299: Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contact Form by Supsystic WordPress pluginto a version that resolves this vulnerability.Fixed in 1.11.1
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Sites using Contact Form by Supsystic versions before 1.11.1 are exposed when a logged-in WordPress administrator can be tricked into visiting an attacker-crafted page.
What can an attacker change if exploitation succeeds?
An attacker can overwrite the plugin's outbound mail settings, including the SMTP server, SMTP credentials, and notification recipient. This can route contact-form notifications through attacker-controlled infrastructure.
How can I determine whether my site may be affected?
Check whether Contact Form by Supsystic is installed and whether its version is earlier than 1.11.1. Review its mail configuration for unexpected SMTP server, credential, or notification-recipient changes.