Supsystic Contact Form CVE-2026-115301

Requires WordPress administrator privileges to place template-injection content into the Supsystic contact-form editor on a site running the plugin before version 1.11.1, where the template engine is not sandboxed. The limiting factor is that only an administrator can store the payload (PR:H), so direct exploitation depends on holding or compromising an admin account; however, once the payload is stored, no authentication or user interaction is needed for the secondary effect - any unauthenticated visitor loading a page that contains the form causes the template to compile and execute, exposing server-side secrets such as authentication salts and database credentials.

Signals point to a real but gated issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:H, 7.2 High) describes a network-reachable, low-complexity flaw whose only brake is PR:H - an attacker must first hold WordPress administrator rights to store the malicious template. SSVC agrees on the gravity of impact (Technical Impact: total) while tempering urgency: Exploitation 'none' (no observed activity) and Automatable 'no' (admin access must be obtained per target). KEV status is NO, so there is no confirmed active exploitation. The vuln.today Decision label is 'this_week', consistent with a serious code-execution flaw that is not yet weaponized. EPSS is not provided in the input, so exploitation probability cannot be quantified here. One important nuance from the description partially conflicts with the PR:H framing: although injecting the payload requires an administrator, the stored template is compiled and executed for ANY visitor who loads the form page, meaning the secondary information-disclosure effect (reading auth salts and DB credentials) is reachable by an unauthenticated visitor once an admin - malicious, coerced, or compromised - has planted the payload. This makes the flaw more dangerous in multi-admin, agency, or compromised-credential scenarios than PR:H alone suggests. Net: a genuine high-impact RCE worth patching promptly, but the administrator precondition keys it below internet-facing unauthenticated bugs in triage.

An attacker who holds (or has phished/compromised) WordPress administrator access opens the Supsystic contact-form editor and stores server-side template injection syntax as form content; because the template engine is not sandboxed, that content is compiled and executed as code when the form renders, yielding arbitrary code execution on the server. Thereafter, every unauthenticated visitor who loads a page containing the form triggers the payload, allowing exfiltration of server-side secrets such as authentication salts and database credentials. A public PoC reference exists (WPScan); it is not verified as working exploit code.