What is the CVSS score of CVE-2026-4257?

CVE-2026-4257 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-4257?

Contact Form by Supsystic WordPress plugin (versions ≤1.7.36) contains a critical unauthenticated remote code execution vulnerability allowing attackers to execute arbitrary commands on affected…

Is there a public PoC exploit available for CVE-2026-4257?

Yes, a public proof-of-concept exploit is available for CVE-2026-4257. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-4257?

Within 24 hours: Identify all WordPress instances using Contact Form by Supsystic plugin ≤1.7.36 via plugin audit tools or WP-CLI; disable the plugin immediately on all affected sites. Within 7 days: Verify no newer version is available from the vendor; if plugin remains necessary, evaluate alternative contact form plugins (e.g., WPForms, Gravity Forms) and migrate forms to the replacement. Within 30 days: Conduct forensic review of access logs and database activity for evidence of exploitation during plugin deployment window; rotate all WordPress admin and database credentials; deploy Web Application Firewall rules to block cfsPreFill GET parameter requests containing Twig syntax.

PHP CVE-2026-4257

EUVD-2026-17239 CRITICAL

Code Injection (CWE-94)

2026-03-30 Wordfence

PHP WordPress RCE Code Injection Contact Form By Supsystic Wordpress Plugin Supsysticcom

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Mar 30, 2026 - 21:45 euvd

EUVD-2026-17239

Analysis Generated

Mar 30, 2026 - 21:45 vuln.today

CVE Published

Mar 30, 2026 - 21:26 nvd

CRITICAL 9.8

DescriptionCVE.org

The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig Twig_Loader_String template engine without sandboxing, combined with the cfsPreFill prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible for unauthenticated attackers to execute arbitrary PHP functions and OS commands on the server by leveraging Twig's registerUndefinedFilterCallback() method to register arbitrary PHP callbacks.

AnalysisAI

Remote code execution in Contact Form by Supsystic plugin for WordPress (all versions ≤1.7.36) allows unauthenticated attackers to execute arbitrary PHP functions and OS commands via Server-Side Template Injection. Attackers exploit the plugin's unsandboxed Twig template engine by injecting malicious Twig expressions through GET parameters in the cfsPreFill functionality, leveraging registerUndefinedFilterCallback() to register arbitrary PHP callbacks. CVSS 9.8 (Critical) with network-accessible, low-complexity attack vector requiring no authentication. EPSS data not provided, but the combination of unauthenticated RCE in a widely-deployed WordPress plugin represents severe real-world risk. No KEV status confirmed at time of analysis.

Technical ContextAI

This vulnerability stems from unsafe implementation of the Twig template engine (specifically Twig_Loader_String) without sandboxing controls in a WordPress contact form plugin (CPE: cpe:2.3:a:supsysticcom:contact_form_by_supsystic). The root cause is CWE-94 (Improper Control of Generation of Code), where user-controlled input from GET parameters flows directly into Twig template rendering. The plugin's cfsPreFill feature, designed to pre-populate form fields, accepts arbitrary GET parameters that are processed as Twig expressions. Attackers can inject Twig syntax like {{_self.env.registerUndefinedFilterCallback('system')}} to register PHP functions (system, exec, shell_exec) as Twig filters, then invoke them to execute OS commands. The vulnerable code path is visible in forms.php line 323 where user input undergoes insufficient sanitization before template rendering. This is a classic SSTI vulnerability where the template engine's intended flexibility becomes an attack vector when user input is not properly isolated from template processing logic.

RemediationAI

Upstream fix available: WordPress plugin repository changeset 3491826 addresses this vulnerability (https://plugins.trac.wordpress.org/changeset/3491826/contact-form-by-supsystic). Site administrators must immediately update Contact Form by Supsystic to version 1.7.37 or later through the WordPress admin dashboard (Plugins > Updates) or via WP-CLI. If immediate patching is not feasible, implement temporary workarounds: disable the Contact Form by Supsystic plugin entirely until patched, implement web application firewall (WAF) rules to block requests containing Twig template syntax in GET parameters (filter for patterns like {{, }}, _self.env, registerUndefinedFilterCallback), or restrict plugin access using authentication layers at the web server level. Audit server logs for suspicious GET requests to plugin endpoints containing Twig expressions as potential indicators of compromise. After patching, conduct security review for any unauthorized files, user accounts, or backdoors that may have been installed if exploitation occurred. Monitor Wordfence advisories for additional technical guidance.