CVE-2026-4257

🗓️ 30 Mar 2026 21:26:10Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 122 Views🌐 WEB

Unauthenticated SSTI in Contact Form by Supsystic up to 1.7.36 enables RCE via prefill Twig expressions.

Reporter	Title	Published	Views	Family All 22
GithubExploit	Exploit for CVE-2026-4257	18 Apr 202619:39	–	githubexploit
GithubExploit	Exploit for CVE-2026-4257	11 May 202605:24	–	githubexploit
GithubExploit	Exploit for CVE-2026-4257	9 Jul 202608:02	–	githubexploit
ATTACKERKB	CVE-2026-4257	30 Mar 202621:26	–	attackerkb
Circl	CVE-2026-4257	30 Mar 202622:20	–	circl
CNNVD	WordPress plugin Contact Form by Supsystic 代码注入漏洞	30 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-4257 Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality	30 Mar 202621:26	–	cvelist
Exploit DB	WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI	14 May 202600:00	–	exploitdb
EUVD	EUVD-2026-17239	31 Mar 202600:31	–	euvd
Metasploit	Supsystic Contact Form Wordpress Plugin SSTI RCE	26 May 202619:01	–	metasploit

Vulners

Node

supsysticcom contact_form_by_supsysticRange≤1.7.36wordpress

[
  {
    "vendor": "supsysticcom",
    "product": "Contact Form by Supsystic",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.7.36",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3491826/contact-form-by-supsystic
plugins	www.plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.7.36/modules/forms/views/forms.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/415c9658-bfb2-453b-a697-c63c08b0ca61

Parameter	Position	Path	Description	CWE
email	query param	/?cfsPreFill=1&email={{7*7}}	SSTI via Twig expression in common form field used by the plugin (cfsPreFill).	CWE-94

17 Jun 2026 10:56Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.19.8

EPSS0.41475

SSVC

CWE-94