CVE-2026-115300

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

CVE-2026-115300

The Contact Form by Supsystic WordPress plugin, in versions before 1.11.1 , is vulnerable to Cross-Site Request Forgery (CSRF) . The application fails to validate CSRF tokens or request origins on two specific administrator-only actions: bulk-deleting captured form submissions and wiping form sta...

EUVD-2026-112609

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

CVE-2026-115300 Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...