CVE-2026-115300: Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Contact Form by Supsystic versions earlier than 1.11.1 are exposed if an administrator can be induced to visit or interact with attacker-controlled content while logged in.
What does an attacker need to exploit the vulnerability?
The attacker does not need administrator credentials, but must trick a logged-in administrator into sending a forged request. The vulnerable actions are restricted to administrators.
What can an attacker do through a successful exploit?
A successful forged request can bulk-delete stored contact form submissions or erase a form's statistics. These actions can permanently destroy stored contact leads and analytics.
Are the affected actions protected by a CSRF token or request-origin check?
No. Before version 1.11.1, the two affected administrator actions do not validate a CSRF token or request origin.