The Contact Form by Supsystic plugin before version 1.11.1 fails to strip carriage‑return/line‑feed characters or re‑validate form field values that are mapped into email headers such as Reply‑To, From, or Cc. This flaw allows an unauthenticated user to insert arbitrary header lines into the notification email, potentially sending the email to unintended recipients or creating spoofed messages. The vulnerability is an example of improper input validation leading to header injection, which undermines email authenticity and confidentiality.

WordPress installations using the Contact Form by Supsystic plugin older than version 1.11.1 are impacted. No other vendor or product is listed. The exact affected versions are all releases prior to 1.11.1.

The CVSS score of 3.7 indicates a medium severity risk. No EPSS score is available, so current exploitation probability cannot be quantified from public data. Since the vulnerability is not listed in CISA’s KEV catalog, there is no confirmed exploitation evidence yet. The attack vector is an unauthenticated user submitting the form with crafted input, and the description explicitly states that the form is configured to map a submitted field into its Reply‑To header, allowing header injection. No elevated privileges are needed. Exploitation could lead to covert email delivery to external parties or user spoofing, which may enable phishing or spam campaigns leveraging the compromised site.