Supsystic Contact Form CVE-2026-115303

Exploitable only when a form is explicitly configured to map a user-submitted field value into its Reply-To, From or Cc email header - this header-mapping configuration is the required, non-default precondition and is what limits exploitation. Given that configuration, exploitation is remote and unauthenticated (PR:N/UI:N): any visitor who can submit the form can inject headers, with no login or user interaction by a victim required. Forms that do not map submitted input into those headers are not affected. Impact is limited to manipulating outgoing notification email headers (e.g. adding Bcc/Cc recipients); affected versions are those before 1.11.1, fixed in 1.11.1.

This is a genuinely low-priority issue by every available signal, and the signals are mutually consistent rather than conflicting. The CVSS 3.1 base score is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N: network-reachable and unauthenticated (PR:N), but high attack complexity (AC:H) and limited to a low integrity impact (I:L) with no confidentiality or availability impact. The limited impact fits the mechanism - injection of extra email headers (e.g. Bcc/Cc) into an outgoing notification email, which tampers with message content/routing but does not disclose protected data or run code. The vuln.today decision label is 'monitor', not act_now or emergency. It is NOT in CISA KEV, and no EPSS score was supplied, so widespread or active exploitation is not indicated. A public PoC reference exists (WPScan) but it is not verified as working exploit code. The AC:H rating is plausibly explained by the exploitation precondition stated in the description (the form must be configured to map a submitted field into a Reply-To/From/Cc header); however, the sources do not explicitly state why AC:H was assigned, so that linkage is inferred, not confirmed. Net: a real but minor header-injection flaw, appropriate to patch on a normal maintenance cycle rather than as an emergency.

An unauthenticated visitor submits the public contact form on a site where an admin has mapped a submitted field (e.g. the sender address) into the email's Reply-To, From or Cc header, embedding CR/LF sequences and extra header lines in that field. The plugin concatenates the unsanitized value into the outgoing notification email headers, so the attacker silently adds Bcc/Cc recipients or otherwise manipulates headers. A public PoC reference exists (WPScan) but is not verified as working exploit code.