{"id":"CVE-2026-115303","aliases":[],"cve":{"records":[{"id":"CVE-2026-115303","source":"WPScan","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-22T09:43:40.292Z","published":"2026-10-29T08:03:46.351Z","modified":"2026-10-29T10:45:50.346Z"}],"publishers":[{"name":"WPScan","role":"CNA","organizationId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","modified":"2026-10-29T08:03:46.351Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T10:45:50.346Z"}],"references":[{"url":"https://wpscan.com/vulnerability/c32e3ccd-84cb-42a4-a343-353a02ccb541/","tags":["exploit","vdb-entry","technical-description"],"source":"WPScan"}],"weaknesses":[{"id":"CWE-93","description":"CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T10:43:06.128153Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping","titleSource":"WPScan","descriptionSource":"WPScan","description":"The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.","score":3.7,"severity":"low","published":"2026-10-29T08:03:46.351Z","modified":"2026-10-29T10:45:50.346Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Unknown","name":"Contact Form by Supsystic","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.11.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-115303"}],"remediation":[],"references":["https://wpscan.com/vulnerability/c32e3ccd-84cb-42a4-a343-353a02ccb541/"],"sources":[{"name":"CVE","id":"CVE-2026-115303","modified":"2026-10-29T10:45:50.346Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115303"}],"assessments":[{"source":"WPScan","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7}],"sourceAffected":[],"observedAt":"2026-10-29T14:34:15.792Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:05:32.453Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T08:40:33.455Z","attemptedAt":"2026-10-29T08:40:33.455Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T08:40:33.364Z","attemptedAt":"2026-10-29T08:40:33.364Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T08:40:33.534Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T08:40:33.321Z","attemptedAt":"2026-10-29T08:40:33.321Z"}],"evidence":[],"aiSummary":{"text":"Contact Form by Supsystic plugin versions before 1.11.1 may allow unauthenticated users to inject email headers. The weakness is due to improper neutralization of CRLF sequences. This can lead to arbitrary email header injection.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:54:08.461Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-115303"}]}}