CVE-2026-4257: Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig TwigLoaderString template engine without sandboxing, combined with the cfsPreFill prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible for unauthenticated attackers to execute arbitrary PHP functions and OS commands on the server by leveraging Twig's registerUndefinedFilterCallback() method to register arbitrary PHP callbacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4257?
CVE-2026-4257 has a high severity rating due to the potential for unauthenticated remote code execution.
How do I fix CVE-2026-4257?
To fix CVE-2026-4257, upgrade the Contact Form by Supsystic plugin to version 1.7.37 or later.
What causes CVE-2026-4257?
CVE-2026-4257 is caused by a vulnerability in the prefill functionality of the Contact Form by Supsystic plugin that allows Server-Side Template Injection.
Who is affected by CVE-2026-4257?
All users of the Contact Form by Supsystic plugin for WordPress up to version 1.7.36 are affected by CVE-2026-4257.
Can CVE-2026-4257 be exploited remotely?
Yes, CVE-2026-4257 can be exploited remotely due to the unauthenticated nature of the vulnerability.