# Contact Form by Supsystic <= 1.10.7 - Unauthenticated Email Header Injection via Form Submission

- **ID:** WPSEC-2026-1519
- **Plugin:** Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics (`contact-form-by-supsystic`), https://wordpress.org/plugins/contact-form-by-supsystic/
- **Affected versions:** all versions before 1.11.1
- **Fixed in:** 1.11.1 (Update to 1.11.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-93
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contact-form-by-supsystic
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1519/

## Description

The Contact Form by Supsystic plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 1.10.7 due to submitted form values being inserted into the To, Cc, From, Reply-To and Subject mail headers without stripping line breaks, and submitted select-box values being used as recipients without validation against the field's options. This makes it possible for unauthenticated attackers to inject additional email headers or change the recipients of notification emails, potentially abusing the site to send spam, when a form is configured to use submitted values in mail headers.

## References

- https://wpsec.com/vuln/WPSEC-2026-1519/
- https://plugins.svn.wordpress.org/contact-form-by-supsystic/tags/1.11.1/
- https://wordpress.org/plugins/contact-form-by-supsystic/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1519/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.