CVE-2026-115303 Details
Description
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
A vulnerability exists in the Contact Form by Supsystic WordPress plugin in versions prior to 1.11.1. The issue arises because the plugin fails to remove carriage return and line feed characters or properly validate submitted field values before adding them to outgoing email headers. This flaw allows unauthenticated users to inject arbitrary email headers, such as additional Bcc or Cc recipients, into the notification email when a form is set to map a submitted field into the Reply-To, From, or Cc header.
Users are advised to update the Contact Form by Supsystic WordPress plugin to version 1.11.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/c32e3ccd-84cb-42a4-a343-353a02ccb541/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Supsystic Contact Form by Supsystic | < 1.11.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |