Supsystic Contact Form CVE-2026-115591

The description states only that the plugin inserts sensitive information into sent data, allowing retrieval of embedded sensitive data in Contact Form by Supsystic from an unspecified version through 1.10.5; the precise trigger (endpoint, parameter, or request type) is not described in the available sources. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation needs only network access to a site running the vulnerable plugin, with no authentication, no user interaction, and low complexity, against the affected versions. The main limiting factor is that the target must be running Contact Form by Supsystic at or below 1.10.5; no non-default configuration requirement is stated in the evidence.

Signals are mixed and lean toward moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H only) describes a network-reachable, unauthenticated information-disclosure flaw with high confidentiality impact but no integrity or availability impact, scoring 7.5. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious but non-critical issue. There is no EPSS score and no CISA KEV listing in the input, so there is no quantitative exploitation-probability signal and no confirmation of active exploitation. The only reference is the Patchstack advisory itself, which is an advisory record rather than verified working exploit code. Net: this is a genuine unauthenticated confidentiality exposure in a public WordPress plugin and worth prompt patching per the 'this_week' label, but it is not a confirmed-exploited, mass-weaponized emergency. The exact data exposed and the precise trigger are not detailed in the available sources, which limits certainty about real-world severity.

A remote, unauthenticated attacker interacts with a WordPress site running Contact Form by Supsystic (≤1.10.5) and causes the plugin to return or embed sensitive information in data it sends, retrieving embedded sensitive data without credentials. No public working exploit code is identified in the input; only a Patchstack advisory reference exists. Because the vector is AV:N/AC:L/PR:N/UI:N, the interaction requires only network access to the vulnerable site with low complexity and no user interaction.