Contact Form by Supsystic (< 1.11.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/contact-form-by-supsystic--1.11.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 13:19:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgContact Form by Supsystic: Server-Side Template Injection (CVE-2026-115301)https://feed.craftedsignal.io/briefs/2026-10-contact-form-supsystic-ssti/Thu, 29 Oct 2026 13:19:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-contact-form-supsystic-ssti/The Contact Form by Supsystic WordPress plugin before 1.11.1 allows authenticated users to perform server-side template injection via unsandboxed form templates, leading to remote code execution and unauthorized access to sensitive server configuration files.The Contact Form by Supsystic WordPress plugin versions prior to 1.11.1 contain a vulnerability where the template engine used for rendering forms is not properly sandboxed. This flaw allows an authenticated administrator to inject arbitrary template code into form-editor content. When a visitor subsequently views a page containing the affected form, the injected template is compiled and executed by the server. This permits arbitrary code execution and the unauthorized disclosure of sensitive server-side information, such as authentication salts and database credentials.

Impact

Successful exploitation allows authenticated attackers to gain remote code execution on the underlying server. Furthermore, the vulnerability impacts unauthenticated visitors, as the stored payload is executed during page rendering, leading to potential exfiltration of environment-specific secrets like database credentials and authentication salts.

Recommendation

  • Upgrade the Contact Form by Supsystic WordPress plugin to version 1.11.1 or later.
  • Audit administrative user access within the WordPress dashboard to identify accounts with form-editing permissions that may have been leveraged for this exploit.
  • Perform a post-patch review of server configuration files, including 'wp-config.php', for unauthorized modifications or access attempts.
]]>highadvisory