Contact Form by Supsystic <= 1.10.7 - Unauthenticated Email Header Injection via Form Submission
- ID
- WPSEC-2026-1519
- Plugin
- Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics (contact-form-by-supsystic)
- Affected
- all versions before 1.11.1
- Remediation
- Update to 1.11.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-93
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Contact Form by Supsystic on WPSec AttackSurface
- Fix released
- Published
Description
The Contact Form by Supsystic plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 1.10.7 due to submitted form values being inserted into the To, Cc, From, Reply-To and Subject mail headers without stripping line breaks, and submitted select-box values being used as recipients without validation against the field's options. This makes it possible for unauthenticated attackers to inject additional email headers or change the recipients of notification emails, potentially abusing the site to send spam, when a form is configured to use submitted values in mail headers.
References
- https://wpsec.com/vuln/WPSEC-2026-1519/
- https://plugins.svn.wordpress.org/contact-form-by-supsystic/tags/1.11.1/
- https://wordpress.org/plugins/contact-form-by-supsystic/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS