CVE-2026-4257 Details
Description
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` template engine without sandboxing, combined with the `cfsPreFill` prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible for unauthenticated attackers to execute arbitrary PHP functions and OS commands on the server by leveraging Twig's `registerUndefinedFilterCallback()` method to register arbitrary PHP callbacks.
A vulnerability allowing server-side template injection (SSTI) has been identified in the Contact Form by Supsystic plugin for WordPress, affecting all versions through 1.7.36. The issue arises from the plugin's use of the Twig template engine, specifically the 'Twig_Loader_String' loader, without proper sandboxing. This vulnerability is exploited through the 'cfsPreFill' functionality, which allows unauthenticated users to inject arbitrary Twig expressions into form fields via GET parameters. By leveraging Twig's capabilities, attackers can execute arbitrary PHP functions and operating system commands on the server.
Users are advised to update the Contact Form by Supsystic plugin to version 1.8.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 30, 2026CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Supsystic Contact Form by Supsystic | <= 1.7.36 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 30, 2026 | New CVE Received | [email protected] |