CVE-2026-4257
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to,…
Published Mar 30, 2026 · updated Jun 17, 2026
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig template engine without sandboxing, combined with the prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible for unauthenticated attackers to execute arbitrary PHP functions and OS commands on the server by leveraging Twig's method to register arbitrary PHP callbacks.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 30, 2026 · NIST NVD
Detected
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig template engine without sandboxing, combined with the prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field value
Jun 17, 2026 · NIST NVD
Updated
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig template engine without sandboxing, combined with the prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field value
Sources
- CVE.orgVulnerability recordCVE-2026-4257
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4257
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig template engine without san
nvd.nist.gov