CVE-2026-115301: Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contact Form by Supsysticto a version that resolves this vulnerability.Fixed in 1.11.1
Event History
Frequently Asked Questions
Who can place a malicious template into a form?
An administrator who can edit form content can place stored form-editor content into the template engine as executable template code.
Does an attacker need to interact with the form after planting the payload?
No. The injected template is compiled and executed whenever any visitor loads a page that contains the affected form.
What can happen when an ordinary visitor views a page with a malicious form?
The stored payload can execute arbitrary code on the server and allow an unauthenticated visitor to read server-side secrets, including authentication salts and database credentials.