Server-Side Template Injection in Contact Form by Supsystic for WordPress

CVE-2026-4257

What is CVE-2026-4257?

The Contact Form by Supsystic plugin for WordPress is susceptible to a Server-Side Template Injection (SSTI) vulnerability that may lead to Remote Code Execution (RCE). This exposure affects all versions up to and including 1.7.36. The flaw arises from the plugin's integration of the Twig Twig_Loader_String template engine without proper sandboxing. Thanks to the cfsPreFill feature, unauthenticated users can inject arbitrary Twig expressions into form fields through GET parameters. This alarming oversight allows attackers to execute arbitrary PHP functions and system commands on the server by exploiting the Twig method registerUndefinedFilterCallback() to register malicious PHP callbacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References