CVE-2026-115301
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor conten…
Impact
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
Affected products
| Product | Affected versions |
|---|---|
| Contact Form By Supsystic WordPress Plugin | before 1.11.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.