WordPress Contact Form Plugin Template Injection Flaw

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Contact Form by Supsystic WordPress plugin before version 1.11.1 contains a critical server-side template injection (SSTI) vulnerability in its template engine. An administrator can inject malicious template code through the form editor, which is then compiled and executed on the server whenever any visitor loads a page containing the affected form. This transforms a stored payload into a persistent code execution threat accessible to unauthenticated users. The vulnerability affects websites using this popular plugin, exposing them to arbitrary code execution, data theft, and complete server compromise. With a CVSS score of 7.2 and the attack surface spanning both authenticated admin actions and unauthenticated visitor access, this represents a significant risk to WordPress installations relying on this plugin for contact functionality.

Casky's 323 matching skills help practitioners detect this vulnerability by mapping to MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Claude AI with extended reasoning analyzes form submission patterns, template syntax anomalies, and code execution artifacts to identify SSTI attempts. Security practitioners using Casky would observe detections such as: unusual template directives in form editor content, suspicious variable expansion patterns, attempts to access system functions or file operations through template syntax, and abnormal server process spawning following form page loads. The platform's skills correlate these indicators with CWE-94 (Improper Control of Generation of Code) to surface the specific injection pattern—distinguishing legitimate template rendering from weaponized payloads designed to achieve code execution before they propagate across visitor sessions.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-115301.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-115301

Casky has 323 skills that investigate the attack patterns behind CVE-2026-115301. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn