CVE-2026-115303 in Contact Form by Supsystic Plugin
Summary
by MITRE • 10/29/2026
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in the Contact Form by Supsystic WordPress plugin prior to version 1.11.1 represents a critical failure in input validation and sanitization, specifically within the handling of form data destined for email headers. This flaw is classified under CWE-74 as Improper Neutralization of Special Elements used in an Output Message Directory or Path, often referred to more broadly in this context as Header Injection. The core technical issue arises from the plugin's logic when mapping user-submitted fields to specific components of outgoing SMTP emails, such as the Reply-To, From, or Cc headers. Instead of strictly validating and sanitizing these inputs against a whitelist of acceptable characters, the application directly concatenates raw field values into the email header string without stripping control characters like carriage return (CR) and line feed (LF). This lack of rigorous filtering allows an attacker to inject additional newline sequences into the input fields.
From an operational perspective, this technical flaw enables unauthenticated attackers to perform Email Header Injection attacks with significant consequences. By injecting CR/LF characters, a malicious actor can terminate the intended header field and append new headers to the email message. This capability is particularly dangerous because it allows the attacker to manipulate the delivery path of the notification emails generated by the contact form. Specifically, an attacker can add arbitrary Bcc or Cc recipients to these messages. Consequently, any sensitive information contained within the user-submitted data from the contact form, such as personal identifiable information (PII), login credentials if included in forms, or other confidential details, can be silently forwarded to unintended third-party addresses. This constitutes a severe confidentiality breach and facilitates potential phishing campaigns where attackers impersonate legitimate entities by manipulating sender headers.
This vulnerability aligns with MITRE ATT&CK technique T1534, which covers Internal Spearphishing, as the attacker leverages trusted email channels from the victim organization to deliver malicious content or exfiltrate data. The attack vector is remote and requires no authentication, making it easily exploitable by any internet user who can access the vulnerable WordPress site's contact form interface. The impact extends beyond simple spam; it undermines trust in the website’s communication channel and exposes users to privacy violations under regulations such as GDPR or CCPA due to unauthorized data sharing with external parties controlled by the attacker.
To mitigate this vulnerability, immediate action is required to update the Contact Form by Supsystic plugin to version 1.11.1 or later, where these input validation flaws have been addressed. In scenarios where an upgrade is not immediately feasible, administrators should implement server-side WAF rules that detect and block HTTP requests containing CR/LF characters within form submission parameters destined for email headers. Additionally, developers must enforce strict allow-listing of permitted characters in all fields mapped to email headers, ensuring that only alphanumeric characters, standard punctuation, and valid domain formats are accepted. It is also advisable to review other plugins handling user input for similar header injection weaknesses, as this pattern is common in poorly coded WordPress extensions. Regular security audits and code reviews focusing on output encoding practices will help prevent recurrence of such issues across the web application ecosystem.