CVE-2026-115303: Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contact Form by Supsysticto a version that resolves this vulnerability.Fixed in 1.11.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using versions before 1.11.1 are exposed when a form maps a submitted field into the Reply-To, From, or Cc email header.
Does an attacker need an account or user interaction?
No. The issue can be exploited by unauthenticated users submitting crafted form values.
What can an attacker do through this issue?
They can inject arbitrary email headers into notification emails, including additional Bcc or Cc recipients.
How can I determine whether a form is affected?
Review the form’s email configuration for submitted fields mapped to Reply-To, From, or Cc headers, and verify whether the plugin version is earlier than 1.11.1.