{"id":"CVE-2026-115301","title":"Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block","summary":"The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-94"],"product":"Contact Form by Supsystic","affected":["contact_form_by_supsystic < 1.11.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-29T10:53:31.460062Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:56:09.041Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115301","references":[{"url":"https://wpscan.com/vulnerability/15274345-5ad4-456f-9b5e-40d575ecb272/"}],"tags":["cve.org"],"epss":0.00422,"epssPercentile":0.36516,"ingestedAt":"2026-11-01T17:57:46.226Z","slug":"CVE-2026-115301","body":"## Overview\n\nThe Contact Form by Supsystic  WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.\n\n## Affected\n\n- `contact_form_by_supsystic < 1.11.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}