Supsystic Contact Form CVE-2026-115299

Exploitation requires an authenticated administrator with access to the plugin's mail-settings page to be socially engineered into visiting an attacker-controlled page while their WordPress session is active - this user interaction (UI:R) is the primary limiting factor, and the attack cannot be automated against the site directly (SSVC Automatable: no). The specific precondition is that the vulnerable code path saving the plugin's mail settings performs no CSRF nonce verification; the site must run Contact Form by Supsystic before version 1.11.1. No attacker authentication is needed (PR:N), and no special non-default plugin configuration is described as required beyond having the plugin installed and active. Impact is limited to the outbound mail/notification configuration (SMTP server, credentials, notification recipient); it does not by itself grant code execution or site availability loss.

This is a moderate, context-dependent risk rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity attack that requires no attacker authentication (PR:N) but does require user interaction (UI:R) - specifically tricking a logged-in administrator into visiting a crafted page. All decision signals agree on a non-critical posture: the SSVC framework reports Exploitation: none, Automatable: no, and Technical Impact: partial, and the vuln.today Decision label is 'this_month' (not act_now or emergency). No EPSS score was supplied, so quantitative exploitation probability is unavailable. The vulnerability is NOT in CISA KEV and there is no confirmed active exploitation; a public PoC reference exists (WPScan) but it is not verified as working exploit code. The impact is bounded but meaningful: because the flaw lets an attacker rewrite SMTP server, credentials and notification recipient, it can silently redirect contact-form notifications (which may contain submitted personal data) through attacker-controlled infrastructure - hence the C:L/I:L rating. The dependence on administrator interaction and the 'Automatable: no' rating are the main factors keeping real-world risk below the raw severity.

An attacker crafts a malicious web page containing a forged request to the plugin's mail-settings save endpoint and lures a logged-in site administrator into visiting it (e.g. via a phishing link). Because no CSRF nonce is verified, the request silently overwrites the SMTP server, credentials and notification recipient, routing all future contact-form notifications through infrastructure the attacker controls. A public PoC reference exists (WPScan) but is not verified as working exploit code.