{
 "id": "WPSEC-2026-1518",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1518/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1518/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1518/index.md",
 "title": "Contact Form by Supsystic <= 1.10.7 - Unauthenticated Missing Authorization to Arbitrary Controller Action Execution and Data Deletion",
 "description": "The Contact Form by Supsystic plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check in the request dispatcher in all versions up to, and including, 1.10.7. The dispatcher (frameCfs::havePermissions()) defaulted to \"allow\" for any controller action it did not recognise and registered every AJAX action under wp_ajax_nopriv_, while the inherited removeGroup() and clear() methods performed no capability check of their own. This makes it possible for unauthenticated attackers to invoke undeclared plugin controller methods, including deleting plugin records such as forms, templates and contacts.",
 "plugin": {
  "slug": "contact-form-by-supsystic",
  "name": "Contact Form by Supsystic",
  "full_name": "Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics",
  "wordpress_org": "https://wordpress.org/plugins/contact-form-by-supsystic/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contact-form-by-supsystic/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contact-form-by-supsystic"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.11.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.11.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.11.1",
 "remediation": "Update to 1.11.1 or later.",
 "fix_released": "2026-10-22T12:53:32+00:00",
 "published": "2026-10-23T13:44:58+00:00",
 "updated": "2026-10-23T09:45:34.823063+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1518/",
  "https://plugins.svn.wordpress.org/contact-form-by-supsystic/tags/1.11.1/",
  "https://wordpress.org/plugins/contact-form-by-supsystic/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contact-form-by-supsystic",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}