Supsystic Contact Form CVE-2026-115595

The plugin must be installed and active; because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction against what appears to be a default configuration. The specific prerequisite - the exact plugin feature, AJAX/admin-post action, or 'access control security level' that is missing an authorization check - is NOT described in the available sources, so the precise trigger is unverified. Limiting factors: impact is confined to integrity (C:N/A:N, I:L), meaning the attacker can perform some unauthorized modification but cannot read sensitive data or cause downtime via this flaw; real-world risk is further bounded by the plugin being one component rather than core infrastructure.

This is a moderate-severity Missing Authorization flaw (CWE-862, CVSS 5.3) whose impact is deliberately narrow: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N describes a remotely reachable, low-complexity, unauthenticated issue (PR:N) with low integrity impact and NO confidentiality or availability impact (C:N/A:N). In plain terms, an unauthenticated actor can invoke some action normally gated behind a higher access level, but the damage is limited to partial unauthorized modification of data/state, not data theft or outage. No EPSS probability is provided in the input, there is no CISA KEV listing, and no public exploit is identified. The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not an emergency. The signals are internally consistent (low, bounded CVSS aligns with a non-KEV, non-urgent label), so this reads as a genuine-but-low-urgency issue rather than a high-CVSS-but-overhyped item or an understated sleeper. The main caveat is specificity: the description ('Exploiting Incorrectly Configured Access Control Security Levels') does not name the exact endpoint or action affected, so the concrete integrity impact cannot be pinned down from the available data.

An unauthenticated attacker sends a crafted HTTP request directly to a plugin endpoint (e.g., an AJAX or admin-post action) that fails to verify the caller's authorization, performing an action that should require an authenticated/privileged user. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this needs no login, no user interaction, and only a reachable WordPress site running the plugin. No public exploit code is identified at time of analysis; the only reference is the Patchstack advisory.