CVE-2026-115302: Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contact Form by Supsysticto a version that resolves this vulnerability.Fixed in 1.11.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it because the affected AJAX action does not restrict access. No account or authentication is required.
What data can be affected?
The issue allows deletion of arbitrary stored form statistics records. The provided information does not indicate that form submissions or other WordPress data can be deleted.
Which installations are affected?
Installations running Contact Form by Supsystic versions earlier than 1.11.1 are affected.