Description
WordPress Contact-form-by-supsystic 插件使用了 Twig“Twig_Loader_String”模板引擎，且没有沙箱处理，结合了“cfsPreFill”预填充功能，允许未经认证的用户通过 GET 参数将任意的Twig 表达式注入表单字段值。
WordPress Contact-form-by-supsystic SSTI注入(CVE-2026-4257)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2026-4257
https://www.wordfence.com/threat-intel/vulnerabilities/id/415c9658-bfb2-453b-a697-c63c08b0ca61?source=cve
https://www.sentinelone.com/vulnerability-database/cve-2026-4257/
https://github.com/bootstrapbool/cve-2026-4257
https://freshysites.com/security-bulletins/wordpress-security-bulletin-contact-form-by-supsystic-plugin-vulnerability-cve-2026-4257/
https://www.rapid7.com/db/vulnerabilities/contact-form-by-supsystic-plugin-cve-2026-4257/
https://hurayraiit.com/blog/cve-2026-4257-contact-form-by-supsystic-ssti-rce/
https://atomicedge.io/cve-proof/cve-2026-4257-contact-form-by-supsystic-version-1-7-36-critical-vulnerability-proof-of-concept/
https://pentest-tools.com/vulnerabilities-exploits/wordpress-contact-form-by-supsystic-server-side-template-injection_29104