CSRF Vulnerability in Contact Form Plugin for WordPress by Supsystic
CVE-2026-115300
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 29 October 2026
Badges
What is CVE-2026-115300?
The Contact Form plugin by Supsystic for WordPress prior to version 1.11.1 is vulnerable to Cross-Site Request Forgery (CSRF). This vulnerability allows attackers to exploit the absence of CSRF token validation on two sensitive administrator-only actions—bulk-deleting captured form submissions and wiping a form's analytics. By deceiving a logged-in administrator into executing a crafted request, attackers can manipulate the site's data, permanently erasing crucial contact leads and analytics from the database. This security gap highlights the importance of implementing proper request validation mechanisms in web applications to safeguard against unauthorized actions.
Affected Version(s)
Contact Form by Supsystic 0 < 1.11.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.