CVE-2026-115595: WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability

Q: What access does an attacker need to exploit this issue?

The available CVSS vector indicates that exploitation can be performed remotely over the network without privileges or user interaction. The attack complexity is rated low.

Q: Which security property is affected?

The CVSS vector indicates an integrity impact of low, with no reported confidentiality or availability impact. The vulnerability is categorized as broken access control caused by missing authorization.

Q: Which plugin versions are affected?

Contact Form by Supsystic versions through 1.10.7 are listed as affected. The provided data does not identify a fixed version.

Published Oct 26, 2026

Updated

Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7.

Affected Software

1 affected component

Supsystic Contact Form by Supsystic<=1.10.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Contact Form by Supsystic to a version that resolves this vulnerability.
Fixed in 1.11.1

Event History

Oct 26, 2026

CVE Published

via MITRE·10:36 AM

Data Sourced

via MITRE·10:36 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The available CVSS vector indicates that exploitation can be performed remotely over the network without privileges or user interaction. The attack complexity is rated low.

Which security property is affected?