# Contact Form by Supsystic <= 1.10.7 - Unauthenticated Missing Authorization to Arbitrary Controller Action Execution and Data Deletion

- **ID:** WPSEC-2026-1518
- **Plugin:** Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics (`contact-form-by-supsystic`), https://wordpress.org/plugins/contact-form-by-supsystic/
- **Affected versions:** all versions before 1.11.1
- **Fixed in:** 1.11.1 (Update to 1.11.1 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contact-form-by-supsystic
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1518/

## Description

The Contact Form by Supsystic plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check in the request dispatcher in all versions up to, and including, 1.10.7. The dispatcher (frameCfs::havePermissions()) defaulted to "allow" for any controller action it did not recognise and registered every AJAX action under wp_ajax_nopriv_, while the inherited removeGroup() and clear() methods performed no capability check of their own. This makes it possible for unauthenticated attackers to invoke undeclared plugin controller methods, including deleting plugin records such as forms, templates and contacts.

## References

- https://wpsec.com/vuln/WPSEC-2026-1518/
- https://plugins.svn.wordpress.org/contact-form-by-supsystic/tags/1.11.1/
- https://wordpress.org/plugins/contact-form-by-supsystic/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1518/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.