---
id: CVE-2026-115301
title: Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
summary: >-
  The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not sandbox
  the template engine used to render its forms and allows stored form-editor
  content to reach that engine as executable template code, enabling an
  administrator…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-94
product: Contact Form by Supsystic
affected:
  - contact_form_by_supsystic < 1.11.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-29T10:53:31.460062Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:56:09.041Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115301'
references:
  - url: 'https://wpscan.com/vulnerability/15274345-5ad4-456f-9b5e-40d575ecb272/'
tags:
  - cve.org
epss: 0.00422
epssPercentile: 0.36516
ingestedAt: '2026-11-01T17:57:46.226Z'
---

## Overview

The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.

## Affected

- `contact_form_by_supsystic < 1.11.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.