CVE-2026-115303— Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping

Quick assessment

Affected

Unknown Contact Form by Supsystic

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Supsystic 开发的 WordPress 插件"Contact Form"在 1.11.1 版本之前，当表单被配置为将提交的字段映射到邮件的 Reply-To、From 或 Cc 头部时，未对提交字段值中的 CR/LF 字符进行过滤，也未在将这些值拼接到发件邮件头部之前进行重新验证。这使得未经身份验证的攻击者能够注入任意邮件头部（例如额外的 Bcc 或 Cc 收件人），从而篡改通知邮件。

CVSS 3.7 · Low Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping

Source: CVE Program / CVE List V5

Vulnerability Description

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Contact Form by Supsystic	0 ~ 1.11.1	-

II. Public POCs for CVE-2026-115303

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115303

请登录查看更多情报信息。

Other References for CVE-2026-115303 (1)

https://wpscan.com/vulnerability/c32e3ccd-84cb-42a4-a343-353a02ccb541/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-115303

Same Patch Batch · Unknown · 2026-10-29 · 28 CVEs total

CVE-2026-103693		Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injectio
CVE-2026-115282		Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosur
CVE-2026-115302		Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
CVE-2026-115301		Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
CVE-2026-115299		Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
CVE-2026-115300		Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
CVE-2026-88928		PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via
CVE-2026-78395		Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
CVE-2026-78396		Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure
CVE-2026-89216		vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter
CVE-2026-108763		Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
CVE-2026-108686		WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
CVE-2026-108685		WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile
CVE-2026-105258		LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
CVE-2026-86794		Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form
CVE-2024-3586		LetterPress < 2.4.0 - Admin+ Stored XSS
CVE-2026-110504		Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization B
CVE-2026-110030		Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
CVE-2026-110983		WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
CVE-2026-110505		Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Contact Form by Supsystic

Same vendor: Unknown