{
 "id": "WPSEC-2026-1520",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1520/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1520/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1520/index.md",
 "title": "Contact Form by Supsystic <= 1.10.7 - Authenticated (Administrator+) Remote Code Execution via Server-Side Template Injection",
 "description": "The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 1.10.7 due to form template parameters and tag values being concatenated directly into Twig templates that were rendered without a sandbox. This makes it possible for authenticated attackers with administrator-level access to execute arbitrary code on the server, which is significant in environments where administrators cannot otherwise modify code, such as multisite installations or sites with file modifications disabled.",
 "plugin": {
  "slug": "contact-form-by-supsystic",
  "name": "Contact Form by Supsystic",
  "full_name": "Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics",
  "wordpress_org": "https://wordpress.org/plugins/contact-form-by-supsystic/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contact-form-by-supsystic/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contact-form-by-supsystic"
 },
 "type": "RCE",
 "cwe": [
  "CWE-1336"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.11.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.11.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.11.1",
 "remediation": "Update to 1.11.1 or later.",
 "fix_released": "2026-10-22T12:53:32+00:00",
 "published": "2026-10-23T13:44:58+00:00",
 "updated": "2026-10-23T09:45:34.823063+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1520/",
  "https://plugins.svn.wordpress.org/contact-form-by-supsystic/tags/1.11.1/",
  "https://wordpress.org/plugins/contact-form-by-supsystic/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contact-form-by-supsystic",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}