Contact Form by Supsystic CVE-2026-73379

No authentication is required - the CVSS vector PR:N and the description 'Unauthenticated Bypass Vulnerability' confirm that exploitation is possible without any valid WordPress credentials. The Contact Form by Supsystic plugin must be installed and activated on a WordPress installation running a version below 1.10.0. No special server configuration, non-default settings, or privileged network position is required; any HTTP client reachable to the target WordPress site can attempt exploitation. Exploitation is limited by the scope of what the bypassed functionality controls: C:L/I:L indicates partial data access or modification rather than full site compromise. Sites where the plugin is installed but deactivated are not exposed.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates medium severity with meaningful real-world risk: the flaw is trivially exploitable over the network with no credentials or user interaction, and yields partial read and write access. The S:U (no scope change) and C:L/I:L (limited confidentiality and integrity impact) constrain the blast radius - full system compromise or data exfiltration is unlikely from this vector alone. No EPSS data was provided and the CVE is not listed in CISA KEV, so exploitation probability and active threat actor interest are unconfirmed. POC availability is unknown. The combination of unauthenticated network exploitation (AV:N/PR:N) with low attack complexity makes opportunistic scanning and automated exploitation plausible, but the limited impact metrics moderate urgency compared to critical-rated auth bypasses. Prioritize patching on internet-exposed WordPress sites where form data or plugin configuration confidentiality matters.

An unauthenticated attacker discovers a WordPress site running Contact Form by Supsystic prior to 1.10.0 through passive recon (e.g., WPScan or HTTP response headers). The attacker sends a crafted HTTP request to a plugin endpoint that bypasses the intended authentication check via an alternate code path, gaining access to protected plugin operations such as reading submitted form entries or modifying plugin configuration. No public exploit code has been confirmed, but the AV:N/AC:L/PR:N/UI:N vector means a working exploit could be developed and automated with minimal effort.