Security Alert Summary
The Contact Form by Supsystic WordPress plugin contains a server-side template injection (SSTI) vulnerability that can lead to remote code execution (RCE). Unauthenticated users can inject arbitrary Twig expressions into form field values via GET parameters using the plugin’s prefill functionality, potentially allowing execution of PHP functions and operating system commands.
CVE Details
- CVE ID:
CVE-2026-4257 - Affected component: Contact Form by Supsystic plugin for WordPress
- Affected versions: All versions up to, and including, 1.7.36
- Published: March 30, 2026 at 10:16:20 PM
- Last modified: March 30, 2026 at 10:16:20 PM
- CVSS v3.1: Base Score 9.8, Severity: CRITICAL, Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User Interaction: Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW; Scope: UNCHANGED
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- CWE: CWE-94 (Improper Control of Generation of Code)
Technical Details
The plugin uses the Twig template engine with the Twig_Loader_String loader without sandboxing, and exposes a prefill feature identified as cfsPreFill. The cfsPreFill functionality accepts GET parameters and inserts their values into form fields. Because Twig templates are processed without proper isolation, an unauthenticated attacker can supply arbitrary Twig expressions via GET parameters.
The description states that an attacker can leverage Twig’s registerUndefinedFilterCallback() to register arbitrary PHP callbacks, which can be used to invoke PHP functions and operating system commands. This combination—unsandboxed template evaluation plus injectable template content via cfsPreFill—is the root cause that enables remote code execution.
How This Could Impact Your Website
In a typical small business WordPress installation, the site owner maintains the plugin set while internal staff or external contractors may have contributor or editor roles. Because this vulnerability can be triggered by unauthenticated GET requests, an external attacker could attempt to inject Twig expressions without interacting with staff accounts. If successful, the attacker could run PHP functions or OS commands that read sensitive files, modify site content, or disrupt service.
Practical consequences include unauthorized disclosure of data stored on the server (for example, configuration files or user data), modification or defacement of site content, and service disruption. The high confidentiality, integrity, and availability impacts in the CVSS score indicate that exploitation can affect multiple aspects of site operation, not only data exposure.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and editors.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from your installation.
- Monitor site activity and logs for unusual behavior, such as unexpected template rendering or unfamiliar commands executed on the server.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.7.36/modules/forms/views/forms.php#L323
- https://plugins.trac.wordpress.org/changeset/3491826/contact-form-by-supsystic
- https://www.wordfence.com/threat-intel/vulnerabilities/id/415c9658-bfb2-453b-a697-c63c08b0ca61?source=cve
