Vulnerability · Published Oct 29, 2026 · Assigned by WPScan

CVE-2026-115303Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping

Low 3.7

In plain English

A low-severity security flaw in Contact Form by Supsystic from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.2%top 86.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Contact Form by Supsystic	0 – before 1.11.1

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/c32e3ccd-84cb-42a4-a343-353a02ccb541/ exploit, vdb-entry, technical-description