CVE-2026-115300 in Contact Form by Supsystic Plugin
Summary
by MITRE • 10/29/2026
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in the Contact Form plugin for WordPress prior to version 1.11.1 represents a critical failure in access control mechanisms, specifically manifesting as Cross-Site Request Forgery within administrative functions. This flaw affects two distinct operational endpoints: one responsible for bulk-deleting captured form submissions and another tasked with wiping statistical data associated with specific forms. In secure web application architecture, actions that modify state or delete persistent data must be protected by robust anti-CSRF measures to ensure that requests originate from legitimate user interactions rather than malicious third-party sites. The absence of CSRF token validation and the lack of request origin verification in these administrative endpoints create a significant security gap that undermines the integrity of the WordPress administration interface.
From a technical perspective, the core issue lies in the server-side processing logic which accepts state-changing HTTP requests without verifying the authenticity of the caller. When an administrator is authenticated via session cookies or tokens stored in their browser, any subsequent request to these vulnerable endpoints will be processed as valid if it reaches the server with appropriate authentication headers, regardless of its source origin. An attacker can exploit this by crafting a malicious webpage containing hidden form submissions or JavaScript-driven requests that target the WordPress admin URLs for deleting submissions and clearing statistics. Upon visiting such a page while logged into their WordPress dashboard, an administrator inadvertently triggers these destructive actions without any explicit consent or awareness, as modern browsers automatically include authentication credentials with cross-origin requests in certain contexts or when specific headers are manipulated by sophisticated attack vectors.
The operational impact of this vulnerability is severe due to the nature of the data involved. Contact forms often serve as primary lead generation channels for businesses and organizations, storing valuable customer information that holds both commercial and privacy significance. The ability to bulk-delete these submissions results in permanent loss of business intelligence and potential compliance violations related to data retention policies. Furthermore, wiping form statistics destroys historical performance metrics essential for marketing analysis and user experience optimization. This dual impact not only causes immediate operational disruption but also erodes trust in the platform's reliability. Attackers with malicious intent can use this capability as a denial-of-service vector against specific business functions or as part of a broader campaign to sabotage organizational operations by removing critical data assets.
This vulnerability aligns closely with CWE-352, which describes Cross-Site Request Forgery (CSRF), and falls under the MITRE ATT&CK technique T1498.002, known as Network Boundary Bridge: Single Source, where an attacker uses a single compromised or controlled source to bridge network boundaries and execute actions on behalf of authenticated users. The exploitation relies heavily on social engineering principles, requiring only that the victim administrator visits a malicious site while maintaining an active session with the target WordPress installation. This makes it particularly dangerous in environments where administrators frequently browse external websites without logging out of administrative panels.
To mitigate this risk, immediate action is required to update the Contact Form plugin to version 1.11.1 or later, which includes patches for these specific endpoints. In scenarios where updating is not immediately feasible, temporary mitigations should be implemented at the web server level. This can include restricting access to WordPress admin-ajax.php and related administrative URLs by IP address if possible, although this may limit functionality in dynamic network environments. Additionally, enforcing strict Content Security Policy headers that restrict form submissions to same-origin requests can help prevent some CSRF attacks. Organizations should also review their session management policies, ensuring that administrator sessions have reasonable timeouts to reduce the window of opportunity for such exploits. Regular security audits and penetration testing focused on state-changing operations in administrative interfaces are recommended to identify similar vulnerabilities across other plugins and core WordPress functionalities before they can be exploited.