CVE-2026-115303
Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
| Vendor | unknown |
| Product | contact form by supsystic |
| Published | Oct 29, 2026 |
| Last Updated | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown contact form by supsystic
Be the first to know when new low vulnerabilities affecting unknown contact form by supsystic are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Contact Form by Supsystic
0 < 1.11.1
References
Credits
Emirhan Sevmez WPScan