Vulnerabilities / Contact Form by Supsystic / WPSEC-2026-1520
Contact Form by Supsystic <= 1.10.7 - Authenticated (Administrator+) Remote Code Execution via Server-Side Template Injection
High 7.2
CWE-1336Fixed in 1.11.1
- ID
- WPSEC-2026-1520
- Plugin
- Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics (contact-form-by-supsystic)
- Affected
- all versions before 1.11.1
- Remediation
- Update to 1.11.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-1336
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Contact Form by Supsystic on WPSec AttackSurface
- Fix released
- Published
Description
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 1.10.7 due to form template parameters and tag values being concatenated directly into Twig templates that were rendered without a sandbox. This makes it possible for authenticated attackers with administrator-level access to execute arbitrary code on the server, which is significant in environments where administrators cannot otherwise modify code, such as multisite installations or sites with file modifications disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1520/
- https://plugins.svn.wordpress.org/contact-form-by-supsystic/tags/1.11.1/
- https://wordpress.org/plugins/contact-form-by-supsystic/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS