CVE-2026-115302mediumCWE-862

CVE-2026-115302: falha de média gravidade em Contact Form by Supsystic

Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion

Publicada em

Seguir esta CVE+ Monitorar Contact Form by Supsystic

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 5.3epss 0.2%
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Unknown · Contact Form by Supsystic
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Contact Form by Supsystic

No mesmo produto, das mais perigosas para as menos.

CVE-2026-115301HIGHContact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text BlockEPSS 0.4%CVE-2026-115303LOWContact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field MappingEPSS 0.2%CVE-2025-15705LOWContact Form by Supsystic < 1.8.0 - Admin+ Stored XSSEPSS 0.1%CVE-2026-115300MEDIUMContact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRFEPSS 0.1%CVE-2026-115299MEDIUMContact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRFEPSS 0.1%