CVE-2026-115302mediumCWE-862

CVE-2026-115302: medium-severity vulnerability in Contact Form by Supsystic

Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion

Published

Follow this CVE+ Monitor Contact Form by Supsystic

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Contact Form by Supsystic
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Contact Form by Supsystic

In the same product, most dangerous first.

CVE-2026-115301HIGHContact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text BlockEPSS 0.4%CVE-2026-115303LOWContact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field MappingEPSS 0.2%CVE-2025-15705LOWContact Form by Supsystic < 1.8.0 - Admin+ Stored XSSEPSS 0.1%CVE-2026-115300MEDIUMContact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRFEPSS 0.1%CVE-2026-115299MEDIUMContact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRFEPSS 0.1%