[ CVE-2026-115302 · Published 29 Oct 2026 ]
Vulnerability in Unknown Contact Form by Supsystic
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.