Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
Impact
Contact Form by Supsystic before 1.11.1 allows administrators to perform server-side template injection via form text blocks, potentially executing arbitrary code. An unauthenticated visitor may also read server-side secrets. The weakness is due to improper control of code generation.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Unknown · WPScan
Contact Form by Supsystic
1 range
Unknown · WPScan
Contact Form by Supsystic
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 1.11.1
semver versions
Other versions: unaffected
Original source description
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115301View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.