Template Injection Vulnerability in Contact Form by Supsystic WordPress Plugin
CVE-2026-115301
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 29 October 2026
Badges
What is CVE-2026-115301?
The Supsystic Contact Form plugin for WordPress versions prior to 1.11.1 is vulnerable due to a lack of sandboxing for its template engine. This flaw allows saved form-editor content to be executed as code, leading to server-side template injection. Consequently, an administrator can leverage this vulnerability to embed malicious template code. The harm extends to unauthorized visitors, who can exploit this weakness to access sensitive information stored on the server, including authentication salts and database credentials, whenever the affected form is loaded.
Affected Version(s)
Contact Form by Supsystic 0 < 1.11.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.