CVE-2026-115299 in Contact Form by Supsystic Plugin
Summary
by MITRE • 10/29/2026
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in the Contact Form by Supsystic WordPress plugin prior to version 1.11.1 represents a critical failure in server-side request validation, specifically concerning Cross-Site Request Forgery protections. The core technical flaw lies in the absence of CSRF nonce verification when processing requests intended to update or save mail configuration settings. In secure web application design, state-changing operations such as modifying SMTP credentials must require proof that the request originated from a legitimate user session on the current site. By omitting this check, the plugin allows any HTTP POST request containing valid authentication cookies for an administrator account to be processed by the server without verifying its origin or intent. This architectural oversight effectively neutralizes standard browser-based CSRF defenses, enabling remote attackers to execute administrative actions under the guise of a trusted user.
The operational impact of this vulnerability is severe due to the sensitive nature of email configuration data within WordPress environments. An attacker can exploit this flaw by crafting a malicious webpage that automatically submits a POST request with predefined mail settings when visited by an authenticated administrator. Upon successful execution, the plugin overwrites the site's outbound mail parameters, including the SMTP server address, authentication credentials such as usernames and passwords, and the recipient email addresses for notifications. This manipulation allows the attacker to redirect all contact form submissions and system-generated emails through infrastructure controlled by the adversary rather than the legitimate organization.
This capability facilitates a range of malicious activities beyond simple data interception. By controlling the mail relay, an attacker can harvest sensitive information submitted via the contact forms, including personal identifiable information from customers or users. Furthermore, the compromise of SMTP credentials may allow for further exploitation if those credentials are reused across other services, leading to broader account takeovers. The ability to alter notification recipients also enables phishing campaigns where legitimate-looking emails containing malicious links or attachments can be sent to stakeholders while appearing to originate from a trusted domain. This undermines both data confidentiality and integrity within the WordPress ecosystem.
Mitigation strategies must prioritize immediate patching of the affected plugin version to 1.11.1 or later, which addresses this validation gap by implementing proper CSRF nonce checks for all mail setting modifications. In environments where upgrading is not immediately feasible, administrators should enforce strict access controls on administrative endpoints and utilize security plugins that provide additional layers of request filtering. It is also advisable to review SMTP logs for any unauthorized changes in configuration settings as a forensic measure following suspected exposure. Adhering to industry standards such as CWE-352 regarding Cross-Site Request Forgery will help ensure that future development practices include robust validation mechanisms for all state-changing operations, thereby preventing similar vulnerabilities from being introduced into the application logic.