Risk Letters

Exploited vulnerability

CVE-2026-4257

TLP:CLEAR

supsystic contact_form Improper Control of Generation of Code ('Code Injection')

The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` template engine without sandboxing, combined with the `cfsPreFill` prefill functionality that allows unauthenticated users to inject arbitrary Twig

Facts

  • Vendor: supsystic
  • Product: contact_form
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 41.5 %
  • First known exploitation: 13 October 2026
  • First seen by Risk Letters: 30 March 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD