PT-2026-29130 · WordPress · Contact Form By Supsystic

Azril Fathoni · Published 2026-03-30 · Updated 2026-04-05 · CVE-2026-4257

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contact Form by Supsystic plugin for WordPress versions up to and including 1.7.36

Description The Contact Form by Supsystic plugin for WordPress is susceptible to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE). This occurs because the plugin utilizes the Twig Twig Loader String template engine without proper sandboxing. The cfsPreFill functionality allows unauthenticated users to inject arbitrary Twig expressions into form field values through GET parameters. Attackers can exploit the registerUndefinedFilterCallback() method within Twig to register arbitrary PHP callbacks, ultimately enabling the execution of PHP functions and operating system commands on the server.

Recommendations Update the Contact Form by Supsystic plugin to a version newer than 1.7.36.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-4257

Affected Products

Contact Form By Supsystic

References · 15

• 🔥 https://exploit-db.com/exploits/52564 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4257 · Security Note
• https://twitter.com/OrizonCyber/status/2038768259760017553 · Twitter Post
• https://twitter.com/TheHackerWire/status/2038743009437900868 · Twitter Post
• https://reddit.com/r/wpsafety/comments/1scywd0/weekly_cve_roundup_critical_rce_in_everest_forms · Reddit Post
• https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.7.36/modules/forms/views/forms.php#L323 · Note
• https://twitter.com/1ZRR4H/status/2039587805450420534 · Twitter Post
• https://twitter.com/CVEnew/status/2038916078026498085 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/415c9658-bfb2-453b-a697-c63c08b0ca61?source=cve · Note
• https://twitter.com/pdnuclei_bot/status/2039055162510389470 · Twitter Post
• https://twitter.com/CveFindCom/status/2038748840858194278 · Twitter Post
• https://reddit.com/r/wpsafety/comments/1sczjty/state_of_wordpress_security_34951_cves_tracked · Reddit Post
• https://plugins.trac.wordpress.org/changeset/3491826/contact-form-by-supsystic · Note
• https://twitter.com/BreakGlassIntel/status/2039600203838234793 · Twitter Post
• https://twitter.com/0dayPublishing/status/2038736607033892946 · Twitter Post