Contact Form by Supsystic <= 1.10.7 - Unauthenticated Missing Authorization to Arbitrary Controller Action Execution and Data Deletion
- ID
- WPSEC-2026-1518
- Plugin
- Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics (contact-form-by-supsystic)
- Affected
- all versions before 1.11.1
- Remediation
- Update to 1.11.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Contact Form by Supsystic on WPSec AttackSurface
- Fix released
- Published
Description
The Contact Form by Supsystic plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check in the request dispatcher in all versions up to, and including, 1.10.7. The dispatcher (frameCfs::havePermissions()) defaulted to "allow" for any controller action it did not recognise and registered every AJAX action under wp_ajax_nopriv_, while the inherited removeGroup() and clear() methods performed no capability check of their own. This makes it possible for unauthenticated attackers to invoke undeclared plugin controller methods, including deleting plugin records such as forms, templates and contacts.
References
- https://wpsec.com/vuln/WPSEC-2026-1518/
- https://plugins.svn.wordpress.org/contact-form-by-supsystic/tags/1.11.1/
- https://wordpress.org/plugins/contact-form-by-supsystic/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS