Unauthenticated Twig template injection to RCE in Contact Form by Supsystic for WordPress (CVE-2026-4257)
Three public exploits for this unauthenticated RCE are catalogued in VulnCheck XDB and VulnCheck added the flaw to its KEV catalog on 2026-10-13; a site still running 1.7.36 or earlier is a one-request target.
The plugin renders form field values through Twig's string loader without a sandbox, and the cfsPreFill prefill feature lets anyone inject Twig expressions through GET parameters. An unauthenticated attacker can execute arbitrary PHP functions and OS commands on the web server.
Affected: Contact Form by Supsystic (contact-form-by-supsystic) for WordPress <= 1.7.36
How to Test
In WordPress Admin > Plugins, confirm the Contact Form by Supsystic version; anything at or below 1.7.36 is affected. Review web server access logs for requests to pages with embedded forms carrying cfsPreFill GET parameters containing Twig syntax such as '{{' or '}}' and function names like 'register', and inspect the server for unexpected PHP files or webshells in wp-content and the uploads directory; treat any such hit as a compromise.
How to Patch
Update the plugin to the latest release later than 1.7.36 from WordPress.org (the fix is in changeset 3491826 of contact-form-by-supsystic). If you cannot update immediately, deactivate the plugin or block requests containing cfsPreFill parameters at the WAF until you can.