CVE-2026-115302 PUBLISHED

Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion

Assigner: WPScan
Reserved: 22.10.2026 Published: 29.10.2026 Updated: 29.10.2026

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.

Product Status

Vendor Unknown
Product Contact Form by Supsystic
Versions Default: unaffected
  • affected from 0 to 1.11.1 (excl.)

Credits

  • Md. Moniruzzaman Prodhan (NomanProdhan) finder
  • WPScan coordinator

References

Problem Types

  • CWE-862 Missing Authorization CWE