The Supsystic Contact Form by Supsystic plugin contains a flaw that allows the insertion of sensitive information into the data that the plugin sends. This information‑exposure bug (CWE‑201) enables an attacker to retrieve embedded sensitive data, potentially including credentials or other secrets, whenever the form is processed. The impact is a direct compromise of confidentiality for any data exposed by the plugin.

Supsystic Contact Form by Supsystic plugin for WordPress, versions from the vendor’s earliest release through 1.10.5 are affected. Updated versions 1.10.7 and later are not vulnerable.

The CVSS score of 7.5 signifies high severity, and although the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local or remote via the WordPress site—any user who can submit or otherwise trigger the form may be able to access the sensitive data that the plugin exposes. The flaw does not require privileged access, so remote exploitation is possible.