CVE-2026-4257: Supsystic Contact Form Plugin for WordPress: Server-Side Template Injection
CVE-2026-4257 is a server-side template injection flaw in the Contact Form by Supsystic plugin for WordPress, affecting all versions up to and including 1.7.36. The CNA Wordfence scored it CVSS 3.1 9.8 Critical and describes possible remote code execution by unauthenticated users. The sources consulted show no confirmed exploitation, and the record does not identify a fixed version.
Overview
The Contact Form by Supsystic plugin for WordPress contains a server-side template injection (SSTI) weakness classified as CWE-94 (Code Injection). According to the record, the flaw stems from the plugin rendering form field values through a Twig template engine without sandboxing, and a prefill feature accepts input from unauthenticated requests.
Impact
The description states that the weakness can lead to remote code execution on the web server. The CVSS 3.1 vector rates confidentiality, integrity and availability impact as High, with no privileges or user interaction required.
- Successful exploitation would, per the description, allow code execution in the context of the web server.
- Sites running the affected plugin are exposed regardless of whether they have user accounts.
Affected products and versions
The description states that all versions up to and including 1.7.36 are affected. The structured affected-products list in the record is empty, so the exact version range should be confirmed against the vendor and the Wordfence entry.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS estimate in the record is a probability model output and is not evidence that exploitation has occurred.
Remediation and mitigation
- Identify all WordPress sites running the Contact Form by Supsystic plugin, including versions up to 1.7.36.
- Check the plugin changeset and the Wordfence entry for the first release that contains the fix, and update as soon as a fixed version is confirmed.
- If the plugin is not essential, deactivate and remove it until a fixed version is applied.
- Where possible, limit access to form pages and restrict unnecessary use of the prefill feature while waiting for an update.
Detection guidance
- Review web server and WAF logs for unusual query string content sent to pages that host the plugin's forms, especially parameters that contain template-like syntax.
- Monitor for unexpected PHP processes, new files or outbound connections originating from the web server account.
- Audit WordPress installations for plugin versions and compare them with the vendor's release information.
Limitations of the available information
The record does not name a fixed version, and the structured fixes list is empty. The NVD source status is recorded as Deferred, and its meaning is not documented in the record. The changeset reference suggests a code change but does not confirm which release includes it.
Frequently asked questions
Which versions are affected?
The description states that all versions up to and including 1.7.36 are affected. The structured affected-products list is empty, so confirm the exact range with the vendor and the Wordfence entry.
Is this CVE being exploited in the wild?
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The EPSS value is a probability estimate, not proof of exploitation.
What should site owners do now?
Identify sites running the plugin, check for a confirmed fixed release, remove the plugin if it is not needed, and monitor logs for unusual requests to form pages.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.