{"id":"CVE-2026-115303","title":"Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping","summary":"The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field i…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-93"],"product":"Contact Form by Supsystic","affected":["contact_form_by_supsystic < 1.11.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T10:43:06.128153Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:45:50.346Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115303","references":[{"url":"https://wpscan.com/vulnerability/c32e3ccd-84cb-42a4-a343-353a02ccb541/"}],"tags":["cve.org"],"epss":0.00224,"epssPercentile":0.13044,"ingestedAt":"2026-11-01T17:57:46.214Z","slug":"CVE-2026-115303","body":"## Overview\n\nThe Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.\n\n## Affected\n\n- `contact_form_by_supsystic < 1.11.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}