Contact Form by Supsystic: Server-side template injection via form text block
Summary
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox its template engine, so form-editor content is compiled and executed as template code. An administrator can use this to inject server-side template code and execute arbitrary code on the server. The stored payload runs whenever a visitor loads a page with the form, so an unauthenticated visitor can also read server-side secrets such as authentication salts and database credentials.
Affected
- Contact Form by Supsystic plugin versions before 1.11.1 (CNA record)
- VulDB lists up to and including 1.11.0
Fixed in
- Version 1.11.1 (according to VulDB and Threat Radar; not verified against the vendor changelog)
Workaround
Unknown.
Exploitation
- No known exploitation in the wild according to Threat Radar; CISA SSVC: Exploitation none
- No public proof of concept found
- VulDB labels the entry '0-Day'; the meaning of this label has not been verified
Our recommendation
- Check the installed plugin version on every WordPress site that uses this plugin.
- Update to 1.11.1 or later and confirm the fix in the WordPress.org changelog or with the vendor.
- Limit administrator accounts and enable two-factor authentication.
- Review stored form content for unexpected template syntax.
- If a site ran version 1.7.36 or earlier, treat it as possibly compromised and check for indicators of CVE-2026-4257.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan: Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block wpscan.com
- VulDB: CVE-2026-115301 entry 428308 vuldb.com
- VulDB: CVE-2026-115301 vuldb.com
- Strix: CVE-2026-115301 www.strix.ai
- Threat Radar: CVE-2026-115301 (CWE-94) radar.offseq.com
- WordPress.org: Contact Form by Supsystic en-au.wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 03:23.
Original description (NVD)
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.