CVE-2026-4257 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected Product**: Contact Form by Supsystic (WordPress Plugin). 📉 **Versions**: Version **1.7.36 and earlier**. 🏢 **Vendor**: Supsystic.

Q: Is exploitation threshold high? (Auth/Config)

📉 **Exploitation Threshold**: **LOW**. 🔑 **Auth**: None required (Unauthenticated). 🖱️ **UI**: No user interaction needed. 🌐 **Access**: Network vector (AV:N). Easy to exploit via simple GET requests.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Critical Code Injection in WordPress plugin 'Contact Form by Supsystic'.
💥 **Consequences**: Unauthenticated attackers can inject arbitrary Twig expressions via GET parameters.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-94 (Code Injection).
🔍 **Flaw**: The plugin uses an **unsandboxed Twig template engine** (`Twig_Loader_String`).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected Product**: Contact Form by Supsystic (WordPress Plugin).
📉 **Versions**: Version **1.7.36 and earlier**.
🏢 **Vendor**: Supsystic.

Q4What can hackers do? (Privileges/Data)

⚔️ **Attacker Capabilities**: Full Remote Code Execution.
📊 **Impact**: High Confidentiality, Integrity, and Availability loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
🔓 **Privileges**: No authentication required.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

📉 **Exploitation Threshold**: **LOW**.
🔑 **Auth**: None required (Unauthenticated).
🖱️ **UI**: No user interaction needed.
🌐 **Access**: Network vector (AV:N). Easy to exploit via simple GET requests.

Q6Is there a public Exp? (PoC/Wild Exploitation)

💻 **Public Exploit**: **YES**.
📜 **PoC**: Available via ProjectDiscovery Nuclei templates.
🔗 **Link**: [Nuclei Template](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4257.yaml).…

Read full answer (login)

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for WordPress sites running 'Contact Form by Supsystic' <= v1.7.36.
🛠️ **Tooling**: Use Nuclei with the provided CVE-2026-4257 template.
👀 **Manual**: Look for `cfsPreFill` functionality and unsand…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**.
📅 **Patch Date**: Published 2026-03-30.
🔗 **Reference**: [WordPress Plugin Trac Changeset](https://plugins.trac.wordpress.org/changeset/3491826/contact-form-by-supsystic).…

Read full answer (login)

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 
**Disable** the plugin if not essential.
**WAF Rules**: Block GET parameters containing Twig syntax (e.g., `{{`, `}}`, `{%`).
…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**.
⚠️ **Priority**: **P1 (Immediate Action)**.
📢 **Reason**: Unauthenticated RCE with public PoC. High CVSS score (9.8+ implied by vector).…

Read full answer (login)

Continue exploring

Vulnerability detail Full AI analysis (login) supsysticcom CWE-94