The vulnerability arises because the Contact Form by Supsystic plugin fails to enforce authentication before allowing deletion of stored form statistics through an AJAX endpoint. This enables unauthenticated visitors to request the deletion of arbitrary statistics entries, leading to data loss and potentially obscuring audit trails, thereby undermining the integrity and availability of the site’s analytics.

The flaw affects WordPress installations running the Contact Form by Supsystic plugin with any version prior to 1.11.1. All sites that have the plugin installed without updating to the patched release are vulnerable.

Attackers can exploit this by sending a crafted AJAX request to the endpoint without any credentials. Because the action lacks authentication checks, any visitor can trigger the deletion. The EPSS score is not available; however, the CVE is not listed in KEV, suggesting limited public exploitation at the moment. Despite this, the potential impact of arbitrary data loss and disruption of post‑backed audit logs makes the risk moderate to high for sites that rely on these statistics. The vulnerability is likely vulnerable to automated attacks since the endpoint is accessible via standard HTTP requests.