Supsystic Contact Form CVE-2026-115302

The only prerequisite is a target running Contact Form by Supsystic prior to 1.11.1 with the plugin active so its AJAX handler is registered; exploitation then works against default configurations with no authentication, no user interaction, and no special settings (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is impact scope, not access difficulty: the flaw only permits deletion of stored form-statistics records (integrity of analytics data), with no confidentiality or site-availability impact and no path to code execution, so the realistic harm is loss/tampering of form-submission statistics rather than compromise of the site.

This is a genuine but low-severity, narrowly-scoped issue rather than a high-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, remote, unauthenticated, no-interaction flaw, which explains why SSVC marks it Automatable:yes - a script could hit the endpoint at scale. However, the technical impact is deliberately bounded: CWE-862 missing authorization on one AJAX action, and the vector sets C:N and A:N with only I:L, because the only consequence is deletion of stored form-statistics records (loss of integrity of analytics data), not code execution, data theft, or site takeover. SSVC Exploitation is 'none', the vuln.today Decision label is 'this_month' (not act_now/emergency), it is NOT in CISA KEV, and no EPSS score was supplied. A PoC reference exists but is not verified as working exploit code. The signals are consistent - easily exploitable but low consequence - so this is a real-but-low-urgency hygiene fix, not a drop-everything priority. Note: EPSS probability was not provided in the input, so widespread-exploitation likelihood cannot be quantified; the 'Authentication Bypass' tag slightly overstates the mechanism, which is actually missing authorization on a single action, not a full authentication bypass.

An attacker sends a crafted unauthenticated request directly to the plugin's unprotected AJAX endpoint on any site running Contact Form by Supsystic before 1.11.1, invoking the action that deletes stored statistics records. Because no authorization check is enforced, the request succeeds and arbitrary form-statistics entries are erased. A public PoC reference (WPScan) exists but is not verified as working exploit code; given AV:N/AC:L/PR:N the request requires no authentication, no user interaction, and low complexity.