Contact Form by Supsystic (< 1.11.1)

The Contact Form by Supsystic WordPress plugin before 1.11.1 allows authenticated users to perform server-side template injection via unsandboxed form templates, leading to remote code execution and unauthorized access to sensitive server configuration files.