Contact Form by Supsystic: Server-Side Template Injection (CVE-2026-115301)

The Contact Form by Supsystic WordPress plugin versions prior to 1.11.1 contain a vulnerability where the template engine used for rendering forms is not properly sandboxed. This flaw allows an authenticated administrator to inject arbitrary template code into form-editor content. When a visitor subsequently views a page containing the affected form, the injected template is compiled and executed by the server. This permits arbitrary code execution and the unauthorized disclosure of sensitive server-side information, such as authentication salts and database credentials.

Impact

Successful exploitation allows authenticated attackers to gain remote code execution on the underlying server. Furthermore, the vulnerability impacts unauthenticated visitors, as the stored payload is executed during page rendering, leading to potential exfiltration of environment-specific secrets like database credentials and authentication salts.

Recommendation

• Upgrade the Contact Form by Supsystic WordPress plugin to version 1.11.1 or later.
• Audit administrative user access within the WordPress dashboard to identify accounts with form-editing permissions that may have been leveraged for this exploit.
• Perform a post-patch review of server configuration files, including 'wp-config.php', for unauthorized modifications or access attempts.