Supsystic Contact Form CVE-2026-115300

Exploitation requires an authenticated WordPress administrator to be tricked, while holding an active logged-in session, into sending a forged request to one of two specific plugin actions: the bulk-delete of captured form submissions and the reset/wipe of a form's statistics. The enabling defect is that neither action validates a CSRF token or checks request origin, so a cross-site request carrying the admin's cookies succeeds. Limiting factors that reduce realistic risk: the attack cannot run without an administrator being socially engineered into clicking or loading attacker-controlled content (UI:R), it cannot be automated at scale (SSVC Automatable=no), and impact is confined to destruction of the plugin's stored submissions and analytics - there is no code execution, data theft, or site takeover. The admin-only actions themselves exist in the plugin's default behavior, so no non-default configuration is needed for the forged request to take effect.

This is a medium-severity CSRF issue (CWE-352) whose signals consistently point to low-to-moderate real-world priority rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) shows a network-reachable, low-complexity flaw needing no attacker privileges, but gated by user interaction (UI:R) - a logged-in administrator must be lured into sending the forged request - with impact limited to integrity (I:L) and no confidentiality or availability loss recorded. The SSVC framework reinforces low urgency: Exploitation=none (no observed exploitation), Automatable=no (each attack requires socially engineering a specific authenticated admin, so it cannot be mass-automated), and Technical Impact=partial. There is no CISA KEV listing and no EPSS score was provided, so exploitation-probability data is missing and cannot be weighed; absence of KEV is consistent with the SSVC 'none' exploitation signal. The supplied PoC is a WPScan reference only and is not verified as working exploit code, so this should not be treated as confirmed weaponized exploitation. The vuln.today decision label is 'this_month', indicating scheduled remediation rather than emergency action. One caveat worth noting for defenders: the CVSS impact is scored only as I:L, which understates the business consequence described - permanent, irreversible destruction of captured contact leads and analytics - so raw CVSS may undersell operational harm to lead-dependent sites even though technical risk is modest.

An attacker hosts a web page containing a hidden auto-submitting form (or image/script) that targets the plugin's bulk-delete-submissions or wipe-statistics admin action. While logged into WordPress, a site administrator is lured into visiting that page, and their browser sends the request with valid session cookies but no CSRF token, causing the stored contact submissions or form statistics to be permanently deleted. A public PoC reference exists (WPScan); it is not verified as working exploit code, and the attack depends on tricking an authenticated admin (UI:R).