5.4
Moyenne
CVE-2026-115299 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail…
Description
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Contact Form by Supsystic 1.11 | premières → < 1.11.1 | 1.11.1 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Contact Form by Supsystic
Les 6 CVE de Contact Form by Supsystic →
CVE-2026-115303
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted…
3.7
Faible
CVE-2026-115302
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes…
5.3
Moyenne
CVE-2026-115301
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its…
7.2
Élevée
CVE-2026-115300
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two…
4.3
Moyenne