A server-side template injection (SSTI) vulnerability has been identified in the Supsystic Contact Form plugin for WordPress, affecting versions up to 1.7.36. The flaw could allow an attacker to execute arbitrary code on a vulnerable site.
The vulnerability was disclosed by researcher bootstrapbool and assigned CVE-2026-4257. It was discovered in the plugin’s form field handling, where user-supplied input gets processed through Twig template rendering without adequate sanitization. By injecting specially crafted Twig expressions into form fields, an attacker can break out of the template context and execute system commands.
The exploit works by sending a GET request with a manipulated cfsPreFill parameter containing a Twig payload. The payload leverages Twig’s convert_encoding filter to decode a base64-encoded command, then executes it via the exec filter callback. Tested successfully on both Ubuntu 24 and Windows 10 environments.
If you’re running this plugin, check your version immediately. Any version at or below 1.7.36 is vulnerable. Update to the latest available version or remove the plugin entirely if a patch hasn’t been released yet. WordPress sites running outdated plugins remain one of the most common attack vectors — this is a good reminder to audit your installed plugins regularly.
