CVE-2026-4257

The Contact Form by Supsystic plugin for WordPress (all versions up to and including 1.7.36) contains an unauthenticated server-side template injection flaw (CWE-94) that leads to remote code execution. The plugin processes form field 'cfsPreFill' prefill values taken from GET parameters using the Twig engine loaded via Twig_Loader_String without any sandboxing, so arbitrary Twig expressions submitted in GET parameters are evaluated server-side. By chaining Twig's registerUndefinedFilterCallback() mechanism to register arbitrary PHP callbacks, an attacker can invoke arbitrary PHP functions and execute OS commands on the host; the network vector requires no privileges and no user interaction, earning a critical CVSS 9.8 score with high impact on confidentiality, integrity, and availability. Any WordPress site running the plugin at version 1.7.36 or earlier is potentially affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, but the 41.5% EPSS score (99th percentile) indicates a high probability of exploitation attempts within the next 30 days; the CVE was assigned by Wordfence.

What to do: Update Contact Form by Supsystic to the latest patched release (any version newer than 1.7.36; the data does not name the specific fixed version). Until patching, consider deactivating or removing the plugin, or apply WAF/virtual-patch rules that block requests carrying Twig template syntax in cfsPreFill-related GET parameters. Review web-server access logs for unusual GET parameters submitted to form endpoints and watch for emerging exploits or KEV listing given the elevated EPSS probability.